Oracle Identity Manager EUVD-2026-24368

The connector's HTTPS interface (Core component of Oracle Identity Manager Connector 12.2.1.4.0) must be network-reachable by the attacker; per CVSS PR:N/UI:N and CWE-306 no authentication, credentials, or user interaction are required against the affected version. Limiting factors: exploitation is bounded to environments actually running the affected 12.2.1.4.0 connector, and to attackers who have network line-of-sight to the connector endpoint - OIM connectors are typically deployed inside enterprise identity infrastructure and are not usually internet-facing, so realistic exposure depends on internal network segmentation rather than any special product configuration flag. Impact is limited to confidentiality and integrity of connector-accessible data (A:N - no availability/DoS impact).

The signals conflict and should be weighed together rather than taken from any single metric. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and CWE-306 describe an easy, unauthenticated, network-facing bypass with high confidentiality and integrity impact - score 9.1 - and CISA SSVC reinforces this with Automatable:yes and Technical Impact:total, meaning a working exploit could be scripted broadly. Countering that, EPSS is only 0.03% (9th percentile) and SSVC Exploitation is 'none', so there is no observed exploitation or public exploit code yet. The realistic read: a genuinely high-severity flaw whose real-world urgency is currently gated by the absence of a public exploit and by OIM's limited, enterprise-internal deployment footprint (identity infrastructure is rarely internet-exposed). This is a real priority for organizations running the affected connector - patch promptly - but the low EPSS reflects niche exposure rather than a contradiction of the high CVSS. Availability impact is A:N, so this is a data-integrity/confidentiality issue, not a denial-of-service risk.

An attacker who can reach the Oracle Identity Manager Connector's HTTPS interface - for example a malicious insider on the corporate network or an attacker who has already gained a foothold - sends crafted requests to the unauthenticated connector function and, without any credentials, reads and tampers with identity data, creating, deleting, or modifying accounts across connected target systems. No user interaction or authentication is required (AV:N/AC:L/PR:N/UI:N), and CISA rates the attack automatable, so the technique could be scripted; however, no public exploit is identified at time of analysis.