Oracle IDM Connector EUVD-2026-61296

Exploitation requires the attacker to hold a valid low-privileged logon on the host infrastructure where Oracle Identity Manager Connector executes (AV:L, PR:L) - remote network-only access is insufficient. High attack complexity (AC:H) indicates the exploit depends on a specific and difficult-to-reproduce system state, timing condition, or sequence of operations, meaning reliable exploitation requires significant environmental knowledge or preparation. A second person other than the attacker must actively interact with the OIMC component during the attack window (UI:R), which is a hard exploitation gate that prevents fully unattended or automated attacks. Affected deployments are limited to Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 only; no other versions are confirmed affected. The combined requirement of local infrastructure access, high complexity, and mandatory third-party interaction significantly narrows the realistic attacker population to insiders, actors who have already compromised accounts on OIMC hosts, or highly targeted operations with advance knowledge of the deployment.

The CVSS 7.2 High score reflects a scope-changing local attack yielding high confidentiality and integrity impact, but real-world exploitation likelihood is substantially dampened by three compounding prerequisites: local infrastructure access, high attack complexity, and mandatory third-party user interaction. No EPSS probability data was present in the source intelligence, preventing quantitative exploitation likelihood comparison; the AV:L/AC:H/UI:R profile places this firmly outside opportunistic or automated attack models. The absence of a CISA KEV entry and any publicly confirmed POC code reinforces that no mass-exploitation activity has been observed, and even a mid-sized municipal IT team in walbrzych running OIMC for identity federation should weigh the attack prerequisites carefully before elevating this above other patching priorities. The scope change metric (S:C) is the most strategically significant signal: successful exploitation could propagate unauthorized access into downstream identity-managed systems across the enterprise, multiplying the effective blast radius beyond what the local attack vector alone suggests - making this a higher concern in shared or multi-tenant infrastructure than its raw attack-vector rating implies.

An attacker with a low-privileged local account on the OIMC infrastructure host exploits a complex, condition-dependent flaw in the Core component - potentially involving a race condition or specific system state - while engineering or waiting for a higher-privileged user to interact with the component, satisfying the mandatory user interaction gate. Upon successful exploitation, the attacker gains unauthorized read and write access to critical identity data managed by OIMC. Because a scope change applies, the attacker's effective access may extend to downstream enterprise systems governed by OIMC provisioning operations, such as directory services or cloud application accounts.