EUVD-2026-37421Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
HTTP-reachable connector (AV:N, AC:L); requires any low-privileged OIM account (PR:L); no user interaction; impact crosses to downstream identity systems (S:C) with full takeover (C:H/I:H/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Mainframe Connectors). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Account takeover in Oracle Identity Manager Connector (Fusion Middleware, Mainframe Connectors component) versions 12.2.1.4.0 and 14.1.2.1.0 allows an authenticated low-privileged attacker to fully compromise the connector over HTTP and pivot to other products via a CVSS scope change. The flaw carries a 9.9 CVSS 3.1 score with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, and CISA KEV does not list it.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (a) network HTTP reachability to the Oracle Identity Manager Connector instance running the Mainframe Connectors component on version 12.2.1.4.0 or 14.1.2.1.0, and (b) valid credentials for any low-privileged account that the connector accepts (PR:L), with no user interaction needed (UI:N) and low attack complexity (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals converge on high real-world risk: AV:N/AC:L/PR:L/UI:N means a single low-privileged HTTP session is enough, S:C reflects impact on downstream identity-connected systems (mainframes, target apps), and C:H/I:H/A:H means complete takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained any low-privileged OIM account (e.g., via phishing of a helpdesk user) sends crafted HTTP requests to the Mainframe Connector endpoint and abuses the flaw to take over the connector process. Because of the scope change, the attacker then leverages the connector's standing privileges to create or elevate accounts on the downstream mainframe identity source, achieving persistent privileged access to systems the connector trusts. |
| Remediation | Apply Patch available per vendor advisory - install the June 2026 Oracle Critical Patch Update fixes for Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 as listed at https://www.oracle.com/security-alerts/cspujun2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all instances of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0; map which systems expose HTTP connections to untrusted networks and which support low-privileged user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Identity Manager Connector
View allIn Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rat
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware) allows a low-privileged r
Takeover of Oracle Identity Manager Connector (Fusion Middleware) is achievable by a low-privileged remote attacker over
Full takeover of Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) is achievable by a low-privilege
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. Rated critical severity (CVSS 9.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command i
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
Vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Ac
Same weakness CWE-284 – Improper Access Control
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today