Identity Manager Connector
Monthly
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be completely taken over by an unauthenticated attacker who has obtained a position on the same physical or adjacent network segment as the connector host. The defect lives in the Core component and is rated difficult to exploit (AC:H), yet a successful attack yields full confidentiality, integrity and availability loss with no credentials and no user interaction required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the connector's role in identity provisioning and directory synchronization makes it a strategically attractive target.
Unauthenticated attackers on the same adjacent network segment can compromise the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0), bypassing authentication to gain unauthorized read/write access to critical data, with scope change potentially affecting other Oracle products. This high-severity vulnerability (CVSS 9.3) requires local network adjacency but no credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers who can reach the network segment adjacent to a host running the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) can fully take over the connector, with confidentiality, integrity and availability all rated High and the impact explicitly extending to additional, connected products through a scope change. Exploitation is rated difficult (AC:H) and requires physical adjacency to the hardware hosting the connector, but needs no credentials and no user interaction. Oracle has published this as part of its Critical Patch Update; no public exploit code and no CISA KEV entry were identified at time of analysis.
Authentication bypass in the Core component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker who can reach the connector's TCP listener to read and modify the identity data it manages, with Oracle explicitly noting the attack may also significantly impact connected downstream products (scope change). Oracle scores it 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) while describing it as difficult to exploit, so the flaw is reachable without credentials but is not trivially automatable. The supplied intelligence contains no EPSS score, no CISA KEV entry, and no evidence of public exploit code at time of analysis.
Local privilege abuse in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 lets an attacker who already holds a low-privileged logon on the host running the connector seize full control of the connector, with high confidentiality, integrity and availability impact (CVSS 7.8). The flaw sits in the Core component of the Fusion Middleware connector and requires local logon, not
Unauthenticated remote attackers can read critical data from the Oracle Identity Manager Connector (Core component) in versions 12.2.1.4.0 and 14.1.2.1.0 by sending crafted HTTP requests, with no authentication or user interaction required. Oracle scores the flaw CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) and classifies it as an authentication bypass with high confidentiality impact only; the scope-change metric means a successful attack can also expose downstream products that the connector reaches. No public exploit code or active exploitation is identified at time of analysis, and EPSS data was not provided, so real-world aggressiveness cannot be quantified.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is achievable by a high-privileged, remote attacker exploiting the Microsoft Active Directory component via LDAP, with confirmed scope change impacting additional Oracle Fusion Middleware products. The vendor-assessed outcome is complete loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of serious but not actively weaponized vulnerabilities pending patch application.
High-severity data compromise in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a network-authenticated, high-privileged attacker to fully read and modify critical identity connector data, with confirmed scope change enabling impact on additional downstream products. The vulnerability is tagged 'Authentication Bypass', suggesting the flaw undermines access control enforcement within the Connector Server component despite requiring elevated initial credentials, resulting in a CVSS 3.1 base score of 8.7. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middleware) is possible for a low-privileged attacker with network access over TLS, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Because the flaw carries a scope change, a successful attack can pivot beyond the connector to significantly impact additional products, driving the CVSS 3.1 base score to 9.9. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical but the low attack complexity makes it a high patching priority.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.
Local privilege escalation in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a low-privileged attacker with local logon access to the hosting infrastructure to achieve full takeover of the connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects straightforward exploitation once local access is obtained - no elevated privileges, no user interaction, and no complex attack conditions are required. No public exploit code or active exploitation has been identified at time of analysis; this is disclosed as part of Oracle's August 2026 Critical Patch Update. Note: The intelligence tag 'Information Disclosure' conflicts with the CVSS C:H/I:H/A:H impact profile and the 'takeover' language in the description - the actual scope of impact is broader than disclosure alone and should not be understated.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) lets a low-privileged, network-adjacent attacker fully compromise the Connector over TLS, with a scope change that can significantly impact other integrated products. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 9.9 (C:H/I:H/A:H). No public exploit is identified at time of analysis, and the issue is addressed in Oracle's August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to reach critical data over HTTP, with a scope change (S:C) meaning the impact extends to additional connected products beyond the connector itself. The vendor rates it CVSS 8.6 with confidentiality-only impact and low attack complexity, and tags indicate an authentication-bypass class weakness. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently based on the vendor's own severity assessment via the July 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) is possible in supported versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the connector over HTTP can compromise it end to end. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. At the time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the low attack complexity and lack of any authentication make it a high-priority patching target.
Privileged tampering and data disclosure in the Oracle Identity Manager Connector (PeopleSoft Applications component) of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 lets a high-privileged, network-based attacker read, create, delete, or modify all connector-accessible data, with a scope change that can significantly impact additional products beyond the connector itself. The CVSS 3.1 base score is 7.7 (C:H/I:H/A:N), but exploitation is rated high-complexity and requires existing high privileges, so this is not a drive-by flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in the Oracle Identity Manager Connector (Generic Unix Connector component) of Oracle Fusion Middleware allows an unauthenticated attacker positioned on the adjacent physical communication segment to modify, create or delete connector-accessible data and to cause a complete, repeatable denial of service. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, and because of a scope change the attack may significantly impact additional integrated products beyond the connector itself. There is no public exploit identified at time of analysis; the flaw is rated CVSS 3.1 8.0 despite high attack complexity.
Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with HTTP network access fully compromise the connector, with a scope change that lets the attack significantly impact other products. Oracle rates it CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical based on the vendor's July 2026 Critical Patch Update disclosure.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware) allows a low-privileged remote attacker with SSH network access to compromise the Generic Unix Connector and pivot into additional Fusion Middleware components via a CVSS scope change. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, with Oracle rating the issue 9.9 due to high confidentiality, integrity, and availability impact across product boundaries. No public exploit identified at time of analysis, but the AV:N/AC:L profile and SSH-reachable attack surface make this a high-priority Oracle CPU item.
Takeover of Oracle Identity Manager Connector (Fusion Middleware) is achievable by a low-privileged remote attacker over HTTP, with a scope-changing impact that extends compromise to additional Oracle products. Oracle rates this 9.9 CVSS 3.1 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, with the fix delivered in Oracle's June 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) is achievable by a low-privileged remote attacker via HTTP against the Generic Unix Connector component, with scope-changed impact reaching additional Oracle Fusion Middleware products. Oracle rates this CVSS 9.9 due to high confidentiality, integrity, and availability impact combined with low attack complexity and minimal privileges. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Account takeover in Oracle Identity Manager Connector (Fusion Middleware, Mainframe Connectors component) versions 12.2.1.4.0 and 14.1.2.1.0 allows an authenticated low-privileged attacker to fully compromise the connector over HTTP and pivot to other products via a CVSS scope change. The flaw carries a 9.9 CVSS 3.1 score with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, and CISA KEV does not list it.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory). Rated high severity (CVSS 8.2), this vulnerability is no authentication required, low attack complexity.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be completely taken over by an unauthenticated attacker who has obtained a position on the same physical or adjacent network segment as the connector host. The defect lives in the Core component and is rated difficult to exploit (AC:H), yet a successful attack yields full confidentiality, integrity and availability loss with no credentials and no user interaction required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the connector's role in identity provisioning and directory synchronization makes it a strategically attractive target.
Unauthenticated attackers on the same adjacent network segment can compromise the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0), bypassing authentication to gain unauthorized read/write access to critical data, with scope change potentially affecting other Oracle products. This high-severity vulnerability (CVSS 9.3) requires local network adjacency but no credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers who can reach the network segment adjacent to a host running the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) can fully take over the connector, with confidentiality, integrity and availability all rated High and the impact explicitly extending to additional, connected products through a scope change. Exploitation is rated difficult (AC:H) and requires physical adjacency to the hardware hosting the connector, but needs no credentials and no user interaction. Oracle has published this as part of its Critical Patch Update; no public exploit code and no CISA KEV entry were identified at time of analysis.
Authentication bypass in the Core component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker who can reach the connector's TCP listener to read and modify the identity data it manages, with Oracle explicitly noting the attack may also significantly impact connected downstream products (scope change). Oracle scores it 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) while describing it as difficult to exploit, so the flaw is reachable without credentials but is not trivially automatable. The supplied intelligence contains no EPSS score, no CISA KEV entry, and no evidence of public exploit code at time of analysis.
Local privilege abuse in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 lets an attacker who already holds a low-privileged logon on the host running the connector seize full control of the connector, with high confidentiality, integrity and availability impact (CVSS 7.8). The flaw sits in the Core component of the Fusion Middleware connector and requires local logon, not
Unauthenticated remote attackers can read critical data from the Oracle Identity Manager Connector (Core component) in versions 12.2.1.4.0 and 14.1.2.1.0 by sending crafted HTTP requests, with no authentication or user interaction required. Oracle scores the flaw CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) and classifies it as an authentication bypass with high confidentiality impact only; the scope-change metric means a successful attack can also expose downstream products that the connector reaches. No public exploit code or active exploitation is identified at time of analysis, and EPSS data was not provided, so real-world aggressiveness cannot be quantified.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is achievable by a high-privileged, remote attacker exploiting the Microsoft Active Directory component via LDAP, with confirmed scope change impacting additional Oracle Fusion Middleware products. The vendor-assessed outcome is complete loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of serious but not actively weaponized vulnerabilities pending patch application.
High-severity data compromise in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a network-authenticated, high-privileged attacker to fully read and modify critical identity connector data, with confirmed scope change enabling impact on additional downstream products. The vulnerability is tagged 'Authentication Bypass', suggesting the flaw undermines access control enforcement within the Connector Server component despite requiring elevated initial credentials, resulting in a CVSS 3.1 base score of 8.7. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middleware) is possible for a low-privileged attacker with network access over TLS, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Because the flaw carries a scope change, a successful attack can pivot beyond the connector to significantly impact additional products, driving the CVSS 3.1 base score to 9.9. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical but the low attack complexity makes it a high patching priority.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.
Local privilege escalation in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a low-privileged attacker with local logon access to the hosting infrastructure to achieve full takeover of the connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects straightforward exploitation once local access is obtained - no elevated privileges, no user interaction, and no complex attack conditions are required. No public exploit code or active exploitation has been identified at time of analysis; this is disclosed as part of Oracle's August 2026 Critical Patch Update. Note: The intelligence tag 'Information Disclosure' conflicts with the CVSS C:H/I:H/A:H impact profile and the 'takeover' language in the description - the actual scope of impact is broader than disclosure alone and should not be understated.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) lets a low-privileged, network-adjacent attacker fully compromise the Connector over TLS, with a scope change that can significantly impact other integrated products. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 9.9 (C:H/I:H/A:H). No public exploit is identified at time of analysis, and the issue is addressed in Oracle's August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to reach critical data over HTTP, with a scope change (S:C) meaning the impact extends to additional connected products beyond the connector itself. The vendor rates it CVSS 8.6 with confidentiality-only impact and low attack complexity, and tags indicate an authentication-bypass class weakness. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently based on the vendor's own severity assessment via the July 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) is possible in supported versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the connector over HTTP can compromise it end to end. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. At the time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the low attack complexity and lack of any authentication make it a high-priority patching target.
Privileged tampering and data disclosure in the Oracle Identity Manager Connector (PeopleSoft Applications component) of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 lets a high-privileged, network-based attacker read, create, delete, or modify all connector-accessible data, with a scope change that can significantly impact additional products beyond the connector itself. The CVSS 3.1 base score is 7.7 (C:H/I:H/A:N), but exploitation is rated high-complexity and requires existing high privileges, so this is not a drive-by flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in the Oracle Identity Manager Connector (Generic Unix Connector component) of Oracle Fusion Middleware allows an unauthenticated attacker positioned on the adjacent physical communication segment to modify, create or delete connector-accessible data and to cause a complete, repeatable denial of service. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, and because of a scope change the attack may significantly impact additional integrated products beyond the connector itself. There is no public exploit identified at time of analysis; the flaw is rated CVSS 3.1 8.0 despite high attack complexity.
Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with HTTP network access fully compromise the connector, with a scope change that lets the attack significantly impact other products. Oracle rates it CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical based on the vendor's July 2026 Critical Patch Update disclosure.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware) allows a low-privileged remote attacker with SSH network access to compromise the Generic Unix Connector and pivot into additional Fusion Middleware components via a CVSS scope change. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, with Oracle rating the issue 9.9 due to high confidentiality, integrity, and availability impact across product boundaries. No public exploit identified at time of analysis, but the AV:N/AC:L profile and SSH-reachable attack surface make this a high-priority Oracle CPU item.
Takeover of Oracle Identity Manager Connector (Fusion Middleware) is achievable by a low-privileged remote attacker over HTTP, with a scope-changing impact that extends compromise to additional Oracle products. Oracle rates this 9.9 CVSS 3.1 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, with the fix delivered in Oracle's June 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) is achievable by a low-privileged remote attacker via HTTP against the Generic Unix Connector component, with scope-changed impact reaching additional Oracle Fusion Middleware products. Oracle rates this CVSS 9.9 due to high confidentiality, integrity, and availability impact combined with low attack complexity and minimal privileges. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Account takeover in Oracle Identity Manager Connector (Fusion Middleware, Mainframe Connectors component) versions 12.2.1.4.0 and 14.1.2.1.0 allows an authenticated low-privileged attacker to fully compromise the connector over HTTP and pivot to other products via a CVSS scope change. The flaw carries a 9.9 CVSS 3.1 score with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, and CISA KEV does not list it.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory). Rated high severity (CVSS 8.2), this vulnerability is no authentication required, low attack complexity.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.