Identity Manager Connector EUVD-2026-37311

Exploitation requires network reachability to the Identity Manager Connector's HTTP interface on Oracle Fusion Middleware 12.2.1.4.0 or 14.1.2.1.0, and a valid low-privileged account on the connector (PR:L) - this is not an unauthenticated internet attack. The affected component is specifically the 'Database User' connector of Identity Manager Connector, so deployments that have not configured or enabled that connector are not exposed. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the scope-changed impact only materializes against environments where the connector is integrated with downstream Fusion Middleware products. Limiting factors are therefore: low-privileged authentication, exposure of the connector HTTP endpoint, and active use of the Database User connector configuration.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H combines network reach, low complexity, only low privileges (an authenticated OIM user role, not admin), no user interaction, and a scope change with full CIA impact on adjacent components - making this one of the highest-severity ratings Oracle issues, hence the 9.9 base score. Scope:Changed is the most operationally important signal: successful exploitation does not stay inside the connector but propagates to other Fusion Middleware products, which is consistent with a connector that holds privileged credentials for downstream targets. EPSS, SSVC, and KEV data were not provided, and no POC, exploit code, or active-exploitation reporting is present in the inputs, so real-world weaponization is currently unknown; given Oracle CPU vulnerabilities are routinely reverse-engineered from patch diffs within weeks, treat this as high priority despite the absence of exploit signals. One caveat: Oracle's narrative says 'easily exploitable' but PR:L still requires some level of valid credentials on the connector, which is a meaningful limiter in well-segmented identity deployments.

An attacker who has obtained any low-privileged credential on the Oracle Identity Manager environment (for example a basic helpdesk or self-service OIM account, or a foothold on a system that can reach the connector over HTTP) sends a crafted request to the Identity Manager Connector's Database User component. The flaw lets them take over the connector and, because of the scope change, pivot the resulting privileges into other Fusion Middleware products the connector integrates with - typically the underlying database identities it manages. No public exploit code is currently identified, but Oracle CPU advisories are commonly reverse-engineered, so weaponization within weeks of the patch is plausible.