Oracle Identity Manager CVE-2026-101497

Exploitation requires network access to the HTTP interface of Oracle Identity Manager and a valid low-privileged authenticated account (CVSS PR:L) - it is not reachable by fully anonymous attackers. The flaw resides specifically in the Connector Framework component of OIM versions 12.2.1.4.0 and 14.1.2.1.0; environments on other versions or without exposed OIM HTTP endpoints are not affected. The practical limiting factor is the authentication requirement: an attacker must already possess credentials to a low-privilege OIM account, which restricts this to insiders or attackers who have already obtained a foothold. Impact is capped at a partial, self-contained denial of service (A:L, S:U) with no data exposure or modification.

This is a genuinely low-priority vulnerability despite being network-reachable. The CVSS 3.1 base score of 4.3 (MEDIUM) is driven entirely by a partial availability impact (A:L) with no confidentiality or integrity consequences (C:N/I:N). Oracle's own 'Easily exploitable' language aligns with the vector's AV:N/AC:L (network, low complexity), but exploitation requires an already-authenticated low-privileged account (PR:L), which meaningfully narrows the attacker population to users who already have a foothold in Oracle Identity Manager. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, and the scope is unchanged (S:U), so the worst realistic outcome is a partial, self-contained service degradation rather than an outage of dependent systems. There are no conflicting signals here - every available source (Oracle advisory, EUVD, CVSS vector) consistently points to a low-impact DoS. The main caveat is that the CWE is listed as N/A and no technical root-cause detail is published, so the specific mechanism of the denial of service cannot be independently verified beyond Oracle's summary.

A low-privileged but authenticated user of Oracle Identity Manager (for example, a self-service or delegated-admin account) sends specially crafted HTTP requests to the Connector Framework component, causing a partial denial of service that degrades or temporarily disrupts identity-management functionality. No public exploit code is identified at the time of analysis, and the low complexity means a valid account is the primary barrier rather than technical difficulty.