CVE-2026-83025

CVE-2026-83025 is a difficult-to-exploit, unauthenticated vulnerability in the Core component of Oracle Identity Manager Connector, part of Oracle Fusion Middleware. A remote attacker with TCP network access to the connector, without any credentials or user interaction, could compromise the connector and — because the vulnerability has a scope change — significantly impact additional products beyond the connector itself. Successful exploitation yields unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to critical data or all data accessible through the Oracle Identity Manager Connector. Affected installations are those running supported versions 12.2.1.4.0 or 14.1.2.1.0. No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83025 to all installations of Oracle Identity Manager Connector running 12.2.1.4.0 or 14.1.2.1.0. In the interim, restrict TCP network access to the connector to trusted hosts only via firewall rules and ACLs, since exploitation requires network reachability but no authentication. Audit connector-accessible data and adjacent Fusion Middleware systems for unauthorized modifications or access, keeping in mind the scope change means impacts may extend beyond the connector itself.