This vulnerability affects Oracle Identity Manager Connector in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. An attacker with physical network access to the communication segment connected to the hardware running the connector can exploit this flaw without authentication. The attack can compromise the connector, resulting in unauthorized creation, deletion, or modification of critical data, with a scope change potentially impacting additional Oracle products. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects an attack vector requiring adjacent network access, low attack complexity, no privileges or user interaction, and high confidentiality and integrity impact without availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability, emphasizing the importance of applying patches to mitigate risk.

The vulnerability allows an unauthenticated attacker with access to the physical communication segment to fully compromise Oracle Identity Manager Connector, leading to unauthorized creation, deletion, or modification of critical data. This compromises confidentiality and integrity of data accessible by the connector and may affect other Oracle products due to scope change. There is no impact on availability. The high CVSS score (9.3) reflects the critical nature of this vulnerability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the official patches provided by Oracle without delay to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches. No alternative mitigations or temporary fixes are indicated in the advisory.