Oracle Identity Manager Connector CVE-2026-46792

Exploitation requires network reachability to the HTTP interface of an Oracle Identity Manager Connector deployment running version 12.2.1.4.0 or 14.1.2.1.0 with the Generic Unix Connector component configured and active, plus a valid low-privileged authenticated session on the platform (CVSS PR:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L), but exploitation is limited to environments that have actually deployed and configured the Generic Unix Connector - installations using only other connector types are not in scope - and the account must be able to invoke connector operations over HTTP.

This is a high-priority finding. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H gives a 9.9 base score, reflecting remote HTTP exploitation, low complexity, only a low-privileged account, no user interaction, and a scope change that pulls additional Fusion Middleware products into the blast radius. There is no EPSS score, no SSVC decision, no CISA KEV listing, and no public POC supplied in the input, so the practical exploitability signal is weaker than CVSS alone implies - exploitation almost certainly requires a valid Identity Manager account, which limits opportunistic mass exploitation. However, Identity Manager is a highly privileged identity-governance platform, so even a low-privileged OIM account compromising the connector and pivoting to other products is a credible enterprise-impact scenario and should be treated as urgent for any internet- or partner-reachable deployments.

An attacker with a low-privileged Oracle Identity Manager account - for example, a help-desk operator or a compromised service principal - sends crafted HTTP requests to the Generic Unix Connector endpoint and abuses the flaw to escalate to full control of the connector. Because the vulnerability has a scope change, the attacker then leverages the connector's trust relationships to pivot into other Fusion Middleware components, manipulating provisioning actions or extracting credentials for downstream target systems. No public exploit identified at time of analysis, so initial weaponization would likely be developed by the attacker from the Oracle CPU advisory.