What is the CVSS score of EUVD-2026-37312?

EUVD-2026-37312 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Identity Manager Connector are affected by EUVD-2026-37312?

A critical privilege escalation vulnerability in Oracle Identity Manager Connector allows attackers to seize complete administrative control of Fusion Middleware systems, compromising the…

How to fix or mitigate EUVD-2026-37312?

Within 24 hours: Inventory all systems running Oracle Identity Manager Connector versions 12.2.1.4.0 or 14.1.2.1.0; document current SSH network access and privileged account holders. Within 7 days: Restrict SSH access to these systems to named authorized administrators only via IP allowlisting and firewall rules; enable real-time logging and alerting for authentication attempts and privilege escalation activities. Within 30 days: Monitor Oracle CPU releases for patch availability for these specific versions; prepare and test patch deployment procedures; maintain all compensating controls until patch is deployed and validated.

Oracle Identity Manager Connector EUVD-2026-37312

| CVE-2026-46794 CRITICAL

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Oracle Identity Manager Connector Privilege Escalation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

SSH-reachable network vector with any low-tier credential and no user interaction; full takeover of the connector pivots into managed systems, justifying S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:00 vuln.today

DescriptionCVE.org

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via SSH to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware) allows a low-privileged remote attacker with SSH network access to compromise the Generic Unix Connector and pivot into additional Fusion Middleware components via a CVSS scope change. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, with Oracle rating the issue 9.9 due to high confidentiality, integrity, and availability impact across product boundaries. No public exploit identified at time of analysis, but the AV:N/AC:L profile and SSH-reachable attack surface make this a high-priority Oracle CPU item.

Technical ContextAI

Oracle Identity Manager (OIM) Connectors are the integration adapters that let OIM provision, reconcile, and manage accounts on downstream target systems; the Generic Unix Connector specifically uses SSH to push user/account operations to Linux and Unix endpoints. Because the connector authenticates to remote systems with privileged service credentials and runs inside the Fusion Middleware/WebLogic stack, a flaw in its SSH-facing logic sits at a trust boundary between the IAM control plane and managed hosts. The CVSS scope change (S:C) indicates the vulnerable component (the connector) can affect resources beyond its own security authority - consistent with abusing the connector's stored target-system credentials or its host WebLogic context. No CWE was assigned by the reporter, so the precise weakness class (command injection, deserialization, auth bypass, etc.) is not disclosed in the Oracle advisory metadata.

RemediationAI

Apply the Oracle Critical Patch Update for June 2026 (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html) to Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 - Oracle does not publish standalone fix version strings outside the CPU bundle, so the CPU release itself is the authoritative remediation. Until the CPU can be applied, restrict network reachability of the OIM Connector SSH interface to a dedicated management VLAN or jump host, rotate and tier-isolate the low-privilege service accounts that can reach the connector (since PR:L is the entire barrier to exploitation), and increase audit logging on SSH sessions to and from the connector and on any target Unix systems it manages; the trade-off is that tightening service-account scope can temporarily break legitimate provisioning workflows, so coordinate with the IAM operations team before pulling credentials.