Oracle Identity Manager Connector EUVD-2026-24380

Exploitation requires an attacker to hold a low-privileged account with network access to the Oracle Identity Manager Connector instance (PR:L per CVSS). The vulnerable code path is specifically within the Microsoft Active Directory component, meaning the OIM Connector deployment must be actively configured to integrate with Active Directory via LDAP - deployments not using the AD connector component are not exposed. High attack complexity (AC:H) indicates that exploitation is not straightforward against default conditions; specific prerequisites such as timing-dependent states, particular LDAP request structures, or environmental configurations must be satisfied. No user interaction is required once conditions are met. Limiting factors include: the requirement for a valid low-privileged credential (unauthenticated exploitation is not possible per PR:L), the non-trivial attack complexity that prevents automated or opportunistic exploitation (confirmed by SSVC Automatable: no), and the constraint that only the Active Directory-connected configuration surface is vulnerable.

Real-world risk is moderate-to-low despite the high integrity impact metric. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N) confirms network reachability but imposes two significant friction points: the attacker must hold a low-privileged account (PR:L) and must overcome high attack complexity (AC:H), which typically indicates race conditions, specific timing windows, or non-default environmental states. EPSS at 0.03% (8th percentile) signals extremely low exploitation activity in the threat landscape, consistent with the SSVC assessment of Exploitation: none, Automatable: no, and Technical Impact: partial. There is no CISA KEV listing and no known public proof-of-concept. The integrity impact is rated High, which elevates CVSS, but this reflects worst-case potential rather than confirmed exploitation behavior. On balance, this vulnerability should be patched in the normal Oracle CPU patching cycle without emergency escalation, but environments where OIM Connector has direct write authority over production Active Directory should prioritize the update given the integrity risk. No conflicting signals are present in the available data.

A low-privileged account holder with LDAP network access to Oracle Identity Manager Connector - such as a standard OIM service account or an internal attacker who has compromised a low-privilege credential - submits a specially crafted LDAP request to the Microsoft Active Directory connector component. By exploiting the improper access control flaw under the specific conditions required by AC:H (such as a race condition or a particular request sequence), the attacker bypasses authorization checks and issues unauthorized create, delete, or modify operations against critical directory objects, potentially altering group memberships, disabling accounts, or reading sensitive directory data. No public proof-of-concept has been identified, so exploitation would require independent vulnerability research.