Oracle Identity Manager Connector EUVD-2026-46897

The only prerequisite is network reachability to the Oracle Identity Manager Connector's HTTP service in an affected version (12.2.1.4.0 or 14.1.2.1.0) - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity are required, so this is remote unauthenticated exploitation against affected deployments of the Oracle Identity Manager Connector. The primary limiting factor is exposure: exploitation requires that the attacker can reach the connector's HTTP endpoint, so deployments that keep the connector on an isolated management network unreachable from untrusted zones materially reduce practical risk. Exploitation is also bounded to the two named supported versions; other releases are not listed as affected in the provided data.

All available severity signals point the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a remotely reachable, low-complexity, unauthenticated attack with total confidentiality, integrity, and availability loss - the 9.8 score is well supported and Oracle explicitly calls it 'easily exploitable.' However, several real-world-risk signals are absent: there is no EPSS score in the input, no CISA KEV listing, no SSVC decision data, and no CWE, so exploitation probability and automatability cannot be quantified from the data provided. There is also no evidence of public exploit code. The net picture is a genuinely high-priority vulnerability on paper (unauthenticated RCE-equivalent takeover) whose in-the-wild exploitation likelihood is currently unquantified rather than confirmed. Note one nuance: the source tags label this 'Information Disclosure,' which is narrower than the description's 'takeover' and full-CIA CVSS impact - the CVSS vector should be treated as authoritative over the tag, but the discrepancy is worth flagging.

An attacker with network access to the Oracle Identity Manager Connector's HTTP interface sends a crafted request to the exposed connector service without any credentials, exploiting the low-complexity flaw to gain full control of the connector. Because the connector mediates privileged identity provisioning against PeopleSoft, the attacker can then read or manipulate identity data and provisioning operations. No public proof-of-concept is identified at this time, but the AV:N/AC:L/PR:N/UI:N profile means exploitation requires only reachability, not user interaction or prior access.