Oracle IDM Connector EUVD-2026-106733

Requires the attacker to have an authenticated low-privileged account with logon access to the infrastructure/host where the Oracle Identity Manager Connector executes (AV:L, PR:L) - remote or unauthenticated exploitation is not possible per the vector. Exploitation targets the Generic REST component and affects Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. Limiting factors that reduce real-world risk: the need for pre-existing local logon credentials and the local-only attack vector mean exposure is confined to users who can already reach the Connector host, so the practical blast radius depends on how many low-privileged accounts share that infrastructure.

The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 7.1) describes a locally exploitable flaw requiring the attacker to already have authenticated logon access (PR:L) to the infrastructure where the Oracle Identity Manager Connector runs - this is NOT a remote, network-reachable, or unauthenticated issue despite the 'Authentication Bypass' tag, which appears inconsistent with a PR:L vector and should be verified against Oracle's advisory. Low attack complexity (AC:L) and no user interaction (UI:N) make exploitation reliable once local access is obtained, with high confidentiality and integrity impact (C:H/I:H) but no availability impact (A:N). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a medium-high severity, authenticated-local issue rather than a mass-exploitable internet-facing emergency. Real priority is moderate: patch in normal Oracle CPU cycles and prioritize where many low-privileged users share the Connector host, but it does not warrant emergency out-of-band response on the data available.

A low-privileged user who already has valid logon access to the server hosting the Oracle Identity Manager Connector (for example a developer, operator, or compromised service account) abuses the Generic REST component to read or modify identity data they should not be able to touch. Because attack complexity is low and no user interaction is needed, the attacker can reliably compromise all Connector-accessible data once local access is established. No public exploit code is identified at time of analysis.