Oracle Identity Manager EUVD-2026-79355

Exploitation requires the attacker to be positioned on the same physical/adjacent communication segment (Layer 2 / local network) as the host running the Oracle Identity Manager Connector - per the CVSS AV:A and the explicit description ('access to the physical communication segment attached to the hardware'). This is NOT remotely exploitable over the internet. Within that constraint no further conditions apply: it is unauthenticated (PR:N), needs no user interaction (UI:N), and has low complexity (AC:L) against the affected versions (Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0). The primary limiting factor is the adjacency requirement - an attacker must already have local network access or a foothold on the segment; the scope change (S:C) means successful attacks can also affect additional connected Oracle products beyond the Connector itself.

The headline CVSS 3.1 base score of 9.3 is driven by a scope change (S:C) plus high confidentiality and integrity impact (C:H/I:H), but the single most important signal is the attack vector: AV:A (Adjacent), not AV:N (Network). The description confirms this explicitly - the attacker must have 'access to the physical communication segment attached to the hardware' where the Oracle Identity Manager Connector runs. This makes the score well-calibrated but the real-world internet-facing risk materially lower than the 9.3 number implies: the flaw is NOT remotely exploitable across the internet and requires L2/adjacent positioning (local LAN segment, VLAN, or broadcast domain). Privileges are genuinely none (PR:N, unauthenticated) and no user interaction is needed (UI:N), with low attack complexity (AC:L), so once an attacker is adjacent, exploitation is straightforward. There is no availability impact (A:N). Exploitation signals are weak-to-absent: no CISA KEV listing, no public POC identified, and no EPSS score is provided in the source data. Oracle's CPU advisory (cspusep2026) provides zero technical detail, which is typical of Oracle disclosures and prevents deeper triage. Net assessment: a real and severe issue for anyone able to reach the affected segment, but the adjacency requirement makes it a targeted-access concern rather than a mass-exploitable remote priority. Prioritize on hosts where the OIM Connector shares untrusted or broad L2 segments; deprioritize relative to the AV:N pre-auth siblings in the same Oracle CPU cluster.

An attacker who has already gained a foothold on the same physical/L2 network segment as the Oracle Identity Manager Connector host (e.g., a compromised adjacent server, a rogue device, or a pivot within the data-center VLAN) sends crafted traffic to the Connector without any credentials. Because the flaw crosses a security scope boundary, successful exploitation lets them read and modify critical identity data and impact additional connected products. No public exploit code has been identified at time of analysis, so this would currently require attacker-developed tooling against an undocumented Oracle flaw.