What is the CVSS score of CVE-2026-46793?

CVE-2026-46793 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Identity Manager Connector are affected by CVE-2026-46793?

Oracle Identity Manager Connector (Fusion Middleware) can be remotely compromised by low-privileged attackers, enabling unauthorized access to connected systems and applications that depend on this…

How to fix or mitigate CVE-2026-46793?

Within 24 hours: Identify and inventory all Oracle Identity Manager systems running versions 12.2.1.4.0 or 14.1.2.1.0. Within 7 days: Apply the June 2026 Critical Patch Update released by Oracle to all affected systems, testing in non-production environments first. Within 30 days: Review access logs for exploitation attempts, validate identity manager configurations for unauthorized changes, and re-test access controls across dependent systems.

Identity Manager Connector CVE-2026-46793

EUVD-2026-37311 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Identity Manager Connector Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable HTTP connector, low complexity, requires only a low-privileged OIM account (PR:L), no user interaction, and scope change with full CIA impact on downstream Fusion Middleware products.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:01 vuln.today

DescriptionCVE.org

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Database User). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Identity Manager Connector (Fusion Middleware) is achievable by a low-privileged remote attacker over HTTP, with a scope-changing impact that extends compromise to additional Oracle products. Oracle rates this 9.9 CVSS 3.1 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, with the fix delivered in Oracle's June 2026 Critical Patch Update.

Technical ContextAI

Identity Manager Connector is a component of Oracle Fusion Middleware's Identity Manager (OIM) suite responsible for provisioning, reconciliation, and credential propagation between OIM and downstream identity stores; the affected component is specifically the 'Database User' connector that brokers identity operations against database targets. Because Identity Manager Connectors sit at the integration boundary between OIM and managed systems, a flaw here typically translates into the ability to manipulate identity workflows or pivot into the underlying target systems. No CWE is published by Oracle (consistent with CPU disclosure practice), so the precise root cause class - authorization bypass, injection, deserialization, or input handling defect - cannot be determined from the available data. CPE coverage is limited to a single wildcard entry (cpe:2.3:a:oracle_corporation:identity_manager_connector:*) without explicit version pinning, so version scoping must be taken from Oracle's advisory.

RemediationAI

Apply Patch available per vendor advisory by installing the fixes shipped in the Oracle June 2026 Critical Patch Update for Fusion Middleware Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, as listed at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle does not publish a separate per-CVE patched build number, so the CPU bundle is the authoritative artifact. Until patching, restrict network reachability of the Identity Manager Connector endpoints to the OIM server tier only (via firewall rules or service-mesh policy) so that the AV:N exposure is reduced to internal trust zones, and audit low-privileged OIM accounts to revoke or rotate any non-essential connector-facing credentials given PR:L is the only privilege barrier. If the Database User connector is not actively used in your deployment, consider unconfiguring or disabling that specific connector instance to remove the attack surface entirely; the trade-off is loss of automated database account provisioning and reconciliation, which must be replaced with manual or alternative workflows. Increase monitoring on connector audit logs for anomalous reconciliation, provisioning, or credential-propagation events that could indicate the scope-change impact reaching downstream products.