CVE-2026-83026

CVE-2026-83026 is a high-severity (CVSS 8.3) flaw in the Core component of the Oracle Identity Manager Connector, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.1.0. It can be triggered by an unauthenticated attacker who has access to the physical communication segment (local/adjacent network) attached to the host where the connector executes; exploitability is rated difficult (high attack complexity). A successful attack results in complete takeover of the Oracle Identity Manager Connector with high confidentiality, integrity, and availability impact, and because of a scope change, attacks may significantly impact additional products beyond the connector itself. Organizations running either affected version in enterprise identity-management deployments are at risk, particularly if network segmentation around OIM infrastructure is weak. There is no known public proof of concept, the flaw is not in the CISA KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Apply Oracle's Critical Patch Update fixes for the Oracle Identity Manager Connector on versions 12.2.1.4.0 and 14.1.2.1.0 as soon as they are available. Enforce strict network segmentation and access controls on the LAN/VLAN segments where OIM Connector servers execute, since exploitation requires adjacency to those hosts. Review logs on connector hosts and connected target systems for anomalous activity, keeping in mind that successful attacks can cascade beyond the connector due to the scope change.