Oracle Identity Manager EUVD-2026-46893

Exploitation requires network access to the Oracle Identity Manager Connector over HTTP and possession of at least a low-privileged account on the OIM instance (CVSS PR:L), with no user interaction and low attack complexity. The affected deployments are specifically Connector versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. Limiting factors: the attacker must already authenticate as a low-privileged user (this is not unauthenticated access), and the OIM Connector HTTP interface must be reachable from the attacker's position - instances isolated to internal management networks materially reduce exposure. The exact triggering feature or configuration is not specified because no CWE was assigned and Oracle does not publish exploitation details.

The signals point to genuinely high priority but with important caveats. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, yielding full CIA impact plus a scope change - hence the 9.9 score. However, several corroborating signals are absent: no EPSS score was provided, the CVE is not in CISA KEV, and no POC or exploit code was identified, so real-world exploitation is not demonstrated. There is no SSVC decision data supplied. The PR:L requirement is a meaningful limiter - an attacker must first hold at least a low-privileged account on the OIM instance - so this is not blind unauthenticated RCE despite the near-maximum score. Net: treat as a critical patch-now item because of the product's sensitivity (it holds credentials to many downstream systems), while recognizing that the elevated score is driven partly by scope change and that no active exploitation is confirmed.

An attacker who has obtained a low-privileged OIM account (for example a self-service or delegated user credential) sends crafted HTTP requests to the Identity Manager Connector Core interface to abuse the flaw and take over the connector. Leveraging the scope change, the attacker then pivots to the privileged credentials and downstream target systems the connector manages, impacting identity data across additional products. No public POC exists at time of analysis, so an attacker would need to develop the exploit independently.