What is the CVSS score of CVE-2026-35294?

CVE-2026-35294 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Identity Manager Connector are affected by CVE-2026-35294?

A critical vulnerability in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows low-privileged users to hijack any user account within the connector and pivot to downstream…

How to fix or mitigate CVE-2026-35294?

Within 24 hours: Inventory all instances of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0; map which systems expose HTTP connections to untrusted networks and which support low-privileged user access. Within 7 days: Implement firewall rules restricting HTTP access to affected connectors; isolate connectors on dedicated VLANs; disable HTTP in favor of HTTPS with mutual certificate authentication where supported. Within 30 days: Subscribe to Oracle security advisories for patches to these versions; deploy security monitoring to alert on account creation/modification events originating from connector accounts.

Oracle Identity Manager Connector CVE-2026-35294

EUVD-2026-37421 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Information Disclosure Oracle Identity Manager Connector Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

HTTP-reachable connector (AV:N, AC:L); requires any low-privileged OIM account (PR:L); no user interaction; impact crosses to downstream identity systems (S:C) with full takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:30 vuln.today

DescriptionCVE.org

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Mainframe Connectors). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Identity Manager Connector (Fusion Middleware, Mainframe Connectors component) versions 12.2.1.4.0 and 14.1.2.1.0 allows an authenticated low-privileged attacker to fully compromise the connector over HTTP and pivot to other products via a CVSS scope change. The flaw carries a 9.9 CVSS 3.1 score with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, and CISA KEV does not list it.

Technical ContextAI

Oracle Identity Manager (OIM) Connectors are the integration layer between OIM and target systems; the Mainframe Connectors subcomponent bridges OIM with legacy mainframe identity stores (e.g., RACF, ACF2, Top Secret) over HTTP-based provisioning APIs. Because the connector mediates identity provisioning and de-provisioning, compromise effectively grants control over downstream identity sources, which is why Oracle scores it with Scope:Changed. The CWE was not assigned by the reporter, so the precise root cause class (e.g., authorization bypass, injection, deserialization) cannot be confirmed from the published advisory; the CPE string cpe:2.3:a:oracle_corporation:identity_manager_connector covers all releases, but Oracle limits the affected list to 12.2.1.4.0 and 14.1.2.1.0.

RemediationAI

Apply Patch available per vendor advisory - install the June 2026 Oracle Critical Patch Update fixes for Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 as listed at https://www.oracle.com/security-alerts/cspujun2026.html. Until patching, restrict network reachability of the connector's HTTP endpoint to OIM servers and trusted administration hosts only (network ACLs or reverse-proxy allow-lists), which removes the AV:N exposure but breaks any out-of-zone provisioning agents; tighten OIM connector account roles so no low-trust users hold the low-privilege role that satisfies PR:L, accepting that this may interrupt delegated administration workflows; and increase audit logging on connector provisioning operations to detect post-compromise changes to mainframe identity stores.