This vulnerability affects Oracle Identity Manager Connector in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It is difficult to exploit and requires the attacker to have access to the physical communication segment attached to the hardware where the connector executes. Successful exploitation can lead to complete compromise of the Oracle Identity Manager Connector, with confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity. Oracle's advisory for the September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 others across multiple products.

Successful exploitation of this vulnerability can result in takeover of the Oracle Identity Manager Connector, affecting confidentiality, integrity, and availability of the system. Due to scope change, additional Oracle products may also be significantly impacted. The vulnerability requires physical network segment access and is difficult to exploit, limiting the attack vector to attackers with specific access.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 should apply the relevant patches promptly to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.