What is the CVSS score of EUVD-2026-37310?

EUVD-2026-37310 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Identity Manager Connector are affected by EUVD-2026-37310?

Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable to complete remote takeover by low-privileged attackers, with scope change cascading impact to all dependent Oracle…

How to fix or mitigate EUVD-2026-37310?

Within 24 hours: Inventory all Oracle Identity Manager Connector instances running versions 12.2.1.4.0 or 14.1.2.1.0 across all environments; immediately restrict HTTP access to administrative networks only and block external connectivity; enable detailed audit logging on all identity management systems. Within 7 days: Deploy Web Application Firewall rules targeting Generic Unix Connector endpoints; engage Oracle support for interim guidance and patch timeline; conduct forensic review of authentication logs for exploitation indicators; implement IP whitelisting for any remaining connector access. Within 30 days: Apply vendor-released patch to all systems immediately upon availability; perform complete security audit of identity management systems; test and validate identity management recovery procedures.

Oracle Identity Manager Connector EUVD-2026-37310

| CVE-2026-46792 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Identity Manager Connector Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Remote HTTP exploitation by an authenticated low-privileged OIM user with no interaction, taking over the connector and impacting other Fusion Middleware products (scope change, full CIA).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:01 vuln.today

DescriptionCVE.org

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) is achievable by a low-privileged remote attacker via HTTP against the Generic Unix Connector component, with scope-changed impact reaching additional Oracle Fusion Middleware products. Oracle rates this CVSS 9.9 due to high confidentiality, integrity, and availability impact combined with low attack complexity and minimal privileges. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle Identity Manager Connector is part of the Oracle Fusion Middleware identity governance stack and provides connectors that synchronize identity data between Oracle Identity Manager (OIM/OIG) and target systems. The vulnerable component, the Generic Unix Connector, brokers provisioning and reconciliation operations against Unix-like target hosts. The CPE 'cpe:2.3:a:oracle_corporation:identity_manager_connector:*' identifies the affected product line, with EUVD specifying Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0. CWE is not assigned by Oracle, but the CVSS vector (network HTTP, low complexity, low privileges, scope change, full CIA impact) is consistent with an authenticated authorization/injection-style flaw in the connector's HTTP-exposed interfaces that breaks out of its own trust boundary into other Fusion Middleware components.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of June 2026 documented at https://www.oracle.com/security-alerts/cspujun2026.html, which is the only authoritative remediation; Oracle CPU notes are the source for exact patched build numbers per supported version (12.2.1.4.0 and 14.1.2.1.0) and should be cross-checked against your installed connector bundle. Until the CPU is applied, restrict network reachability of the Identity Manager Connector HTTP endpoints to the OIM/OIG application tier only via firewall or reverse-proxy ACLs, disable or unconfigure the Generic Unix Connector if it is not in active use (trade-off: any provisioning workflows targeting Unix systems will stop), rotate and tighten the privileges of low-tier OIM accounts, and increase audit logging on connector operations to detect anomalous provisioning calls. No vendor-supplied workaround other than the CPU patch has been published in the input data.