EUVD-2026-79697
GHSA-9fcc-w3f8-r86m
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable interface keeps AV:N with AC:L, but a high-privileged account is required, so PR:H and full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Database Application Table). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Takeover of the Oracle Identity Manager Connector (component: Database Application Table) in Oracle Fusion Middleware is possible for a high-privileged attacker who can reach the affected HTTP interface, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates the flaw 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who already holds elevated privileges can fully compromise confidentiality, integrity and availability of the connector with no user interaction and low attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a high-privileged account on the Oracle Identity Manager Connector (CVSS PR:H) plus network reachability to the connector's HTTP interface on a deployment running 12.2.1.4.0 or 14.1.2.1.0 with the Database Application Table component in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are internally consistent but point to a narrow exposure: CVSS 3.1 gives 7.2 with AV:N/AC:L/UI:N but PR:H, which means the attacker must already hold a high-privilege account on the connector or its management plane - this is a post-authentication escalation/pivot flaw, not a pre-auth remote code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix from Oracle's September 2026 Critical Patch Update, which is the authoritative source for exact patched build numbers for 12.2.1.4.0 and 14.1.2.1.0 (https://www.oracle.com/security-alerts/cspusep2026.html); Oracle CPU patches are cumulative and typically require applying the corresponding CPU for the entire Fusion Middleware stack, so schedule the full patch set rather than the connector in isolation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today