Oracle Identity Manager Connector CVE-2026-35294

Requires (a) network HTTP reachability to the Oracle Identity Manager Connector instance running the Mainframe Connectors component on version 12.2.1.4.0 or 14.1.2.1.0, and (b) valid credentials for any low-privileged account that the connector accepts (PR:L), with no user interaction needed (UI:N) and low attack complexity (AC:L). Limiting factors: deployments that expose the connector only to internal OIM hosts behind network segmentation, sites already on a fixed CPU level, and environments where the low-privileged role surface is tightly scoped will materially reduce the realistic attack surface.

Signals converge on high real-world risk: AV:N/AC:L/PR:L/UI:N means a single low-privileged HTTP session is enough, S:C reflects impact on downstream identity-connected systems (mainframes, target apps), and C:H/I:H/A:H means complete takeover. EPSS and CISA KEV data were not provided, so exploitation probability and active-exploitation status are unknown, and no public PoC was found at time of analysis - so this is currently a 'patch urgently because of impact and ease', not a 'patch because attackers are already using it'. Note one inconsistency to verify: Oracle tags it 'Information Disclosure' but the CVSS shows full CIA impact and 'takeover' wording, so the tag understates the true severity and should not be relied on for triage.

An attacker who has obtained any low-privileged OIM account (e.g., via phishing of a helpdesk user) sends crafted HTTP requests to the Mainframe Connector endpoint and abuses the flaw to take over the connector process. Because of the scope change, the attacker then leverages the connector's standing privileges to create or elevate accounts on the downstream mainframe identity source, achieving persistent privileged access to systems the connector trusts.