CVE-2026-83026 is a vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). It affects supported versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability requires an attacker to have access to the physical communication segment attached to the hardware where the connector executes, making exploitation difficult. Successful exploitation can lead to complete takeover of the Oracle Identity Manager Connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H with a base score of 8.3. Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability can result in full compromise of the Oracle Identity Manager Connector, affecting confidentiality, integrity, and availability of the component. The vulnerability's scope change means that additional Oracle products relying on this connector may also be impacted. However, exploitation requires physical network access to the communication segment, which limits the attack vector.

Oracle has released patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers running affected versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager Connector should apply the provided security patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to mitigate this and other vulnerabilities.