Oracle Identity Manager EUVD-2026-46896

Exploitation requires the attacker to already hold high privileges on the Oracle Identity Manager Connector (CVSS PR:H) and network HTTP access to it (AV:N), and to overcome high attack complexity (AC:H) - Oracle explicitly labels it 'difficult to exploit,' implying dependence on specific conditions or timing the vendor does not detail. No end-user interaction is needed (UI:N). The specific limiting factors are: authenticated high-privilege access to the connector is mandatory (this is not remotely unauthenticated), only the PeopleSoft Applications connector component is in scope, and only versions 12.2.1.4.0 and 14.1.2.1.0 are affected. The scope change (S:C) means successful attacks can extend impact to additional integrated products beyond the connector. Note the vendor 'Authentication Bypass' tag appears inconsistent with the PR:H requirement and should be confirmed with Oracle.

The signals point to a real but constrained risk. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) shows network reachability but two strong gates: high attack complexity (AC:H) and high privileges already required (PR:H), meaning the attacker must be an authenticated, highly privileged actor and still overcome difficult preconditions - Oracle's own text calls it 'difficult to exploit.' The offsetting aggravator is the scope change (S:C): success can significantly impact additional products, and both confidentiality and integrity impacts are High. There is no EPSS score, no SSVC decision, and no KEV listing in the provided data, and no POC is referenced, so exploitation-probability signals are absent rather than confirmed low. Note a conflict: the vendor tag says 'Authentication Bypass' yet the CVSS vector requires PR:H (authenticated) - verify the exact privilege model with Oracle, as a genuine auth-bypass would imply a lower PR than scored. Overall this is a patch-in-normal-cycle item for most, but prioritize higher where OIM holds privileged accounts for many downstream systems.

A malicious or compromised OIM administrator (or a service account with equivalent high privileges) sends crafted HTTP requests to the PeopleSoft Applications connector and, after overcoming the difficult preconditions, reads or tampers with all connector-accessible identity data. Because of the scope change, the attacker leverages the connector's trusted provisioning role to impact additional integrated products - for example altering downstream PeopleSoft accounts or entitlements. No public exploit code is identified at time of analysis.