Oracle Identity Manager EUVD-2026-106734

Requires the attacker to have interactive logon access to the infrastructure/host where the Oracle Identity Manager Connector (LDAP Gateway component) executes, plus low-level privileges on that system (CVSS PR:L, AV:L). Affected deployments are specifically Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. No user interaction is needed (UI:N) and complexity is low (AC:L), so once local authenticated access exists exploitation is straightforward. Limiting factors: this is NOT remotely or network exploitable and NOT unauthenticated - the mandatory local logon and existing privilege requirement substantially constrain the realistic attacker population to insiders or those who have already breached the host.

This is a genuine but bounded enterprise risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1 HIGH) is internally consistent and the key constraint is AV:L combined with PR:L: an attacker must already have local logon access to the infrastructure where the Oracle Identity Manager Connector runs AND hold low-level privileges there. That materially lowers real-world exploitability compared to a network-facing unauthenticated flaw, even though AC:L means exploitation is trivial once that foothold exists. No EPSS score was supplied, the CVE is not in CISA KEV, and no public POC is referenced, so there is no evidence of active or opportunistic exploitation. The high Confidentiality and Integrity impacts (no Availability impact) on an identity-management component are the most concerning element, because compromise of an IAM connector can cascade into broader credential/identity abuse. Signal conflict to note explicitly: the input Tag 'Authentication Bypass' contradicts the official description and CVSS, which require an authenticated, logged-on low-privileged attacker - this is not an unauthenticated auth-bypass, so treat that tag as unreliable and verify against Oracle's CPU advisory.

A low-privileged user (or an attacker who has already gained a limited local foothold, e.g. via a compromised service account) with logon access to the host running the Oracle Identity Manager Connector LDAP Gateway abuses the flaw to read and alter identity data the connector can access. Because the connector brokers identity operations, this enables unauthorized creation, modification, or deletion of account/entitlement data. No public exploit code is identified at time of analysis, and exploitation requires pre-existing local access, limiting opportunistic use.