This vulnerability affects Oracle Identity Manager Connector in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with access to the physical communication segment attached to the hardware where the connector executes can exploit this flaw to compromise the connector. The CVSS 3.1 base score is 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes for this and many other vulnerabilities.

Successful exploitation can result in complete takeover of the Oracle Identity Manager Connector, affecting confidentiality, integrity, and availability of the system. However, exploitation requires physical access to the communication segment, making it difficult to exploit remotely or without such access.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to affected versions 12.2.1.4.0 and 14.1.2.1.0. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the official Oracle advisory.