Threat Intelligence Database

A vulnerability exists in the Oracle Identity Manager Connector component of Oracle Fusion Middleware affecting versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows an unauthenticated attacker with access to the physical communication segment of the hardware running the connector to potentially take over the Oracle Identity Manager Connector. The vulnerability has a high CVSS 3.1 base score of 8.3, indicating significant confidentiality, integrity, and availability impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

CVE-2026-83025 is a high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via TCP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 8.7, indicating significant confidentiality and integrity impacts. Exploitation is considered difficult due to the required attack conditions. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products. Customers are strongly advised to apply the relevant patches promptly to mitigate risk.

CVE-2026-83023 is a high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 8.6, indicating a significant confidentiality impact with no required privileges or user interaction. The vulnerability may also affect additional Oracle products due to scope change. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security fixes across multiple products.

CVE-2026-60996 is a high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. It allows a high privileged attacker with network access via HTTPS to compromise the Oracle Identity Manager Connector, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible through the connector. The vulnerability has a CVSS 3.1 base score of 8.7, indicating significant confidentiality and integrity impacts.

CVE-2026-60994 is a vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with logon access to the infrastructure where the connector runs to potentially compromise it. Exploitation is difficult and requires human interaction from a person other than the attacker. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by the connector, with a scope change potentially impacting additional products.

CVE-2026-60993 is a high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with access to the physical communication segment of the hardware running the connector to potentially take over the Oracle Identity Manager Connector. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality, integrity, and availability.