CVE-2026-83028

CVE-2026-83028 is a difficult-to-exploit, unauthenticated vulnerability in the Core component of the Oracle Identity Manager Connector, part of Oracle Fusion Middleware. Exploitation requires an attacker to have access to the physical communication segment (adjacent network) attached to the hardware where the connector executes — meaning the attacker must already be on the same network segment, such as a compromised host or an insider position in the data center or internal LAN. A successful attack allows complete takeover of the Oracle Identity Manager Connector, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). Affected deployments are those running supported versions 12.2.1.4.0 or 14.1.2.1.0. There is no known public proof of concept and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation in the wild is not evidenced.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83028 to Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 as soon as your patch cycle allows. Because exploitation requires adjacency to the connector's network segment, tighten network segmentation and access controls so only trusted hosts can reach the server hosting the connector. Review logs for anomalous connections or credential activity from hosts sharing that segment.