Oracle Identity Manager Connector EUVD-2026-79697

Exploitation requires a high-privileged account on the Oracle Identity Manager Connector (CVSS PR:H) plus network reachability to the connector's HTTP interface on a deployment running 12.2.1.4.0 or 14.1.2.1.0 with the Database Application Table component in use. No user interaction (UI:N) and no special race or memory condition (AC:L) are needed once those two prerequisites are met. What limits exploitation is therefore the privilege bar rather than the technical difficulty: an anonymous or low-privileged remote attacker cannot trigger this without first obtaining or escalating to the required high-privilege role, and the target interface is typically confined to internal administration networks. Note that the input data does not specify whether the privileged role is a connector-specific account or a broader Fusion Middleware administrator, nor whether any non-default configuration is required - both should be confirmed with Oracle's advisory before finalising exposure assessments.

The signals here are internally consistent but point to a narrow exposure: CVSS 3.1 gives 7.2 with AV:N/AC:L/UI:N but PR:H, which means the attacker must already hold a high-privilege account on the connector or its management plane - this is a post-authentication escalation/pivot flaw, not a pre-auth remote code execution. Availability of an unauthenticated path, an EPSS score, or any KEV listing is not present in the provided data, so widespread opportunistic exploitation should not be assumed; no public exploit identified at time of analysis. Against that, the impact metrics are uniformly High and Oracle classifies successful attacks as full takeover of the connector, so compromise of one privileged account can be converted into control over the identity-synchronisation pipeline feeding downstream systems - a high-value pivot inside an IAM estate, and even a mid-sized municipal IT team in radom should treat this as urgent once its identity stack appears in a scan. Key unknowns: no CWE, no EPSS, no KEV status and no explicit proof-of-concept data were supplied, so the practical exploitability rests on Oracle's own rating rather than independent corroboration.

An attacker who has obtained a high-privileged connector or administrator account - via credential reuse, a shared service account, or a prior foothold in the IAM stack - sends crafted requests over HTTP to the connector's Database Application Table handling interface. Because the request requires no user interaction and the attack complexity is low, the attacker can immediately subvert connector data and configuration, taking over the connector and any identity-provisioning trust it holds. No public exploit code has been identified at time of analysis, so this currently assumes a capable, targeted actor rather than commodity scanning.