CVE-2026-83344 in Identity Manager Connector
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Database Application Table). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Identity Manager Connector component of Oracle Fusion Middleware, specifically affecting the Database Application Table functionality in versions 12.2.1.4.0 and 14.1.2.1.0. This security flaw represents a critical risk to organizations relying on these specific releases for identity governance and access management operations. The vulnerability is characterized by its potential for remote exploitation, allowing an attacker with high-level privileges who has network connectivity via HTTP to compromise the integrity of the Oracle Identity Manager Connector service. While the requirement for high-privileged initial access might seem like a mitigating factor in some contexts, it does not negate the severity of the flaw once that threshold is crossed, as it enables complete control over the connector process.
From a technical perspective, this vulnerability allows an attacker to execute unauthorized actions within the context of the Oracle Identity Manager Connector. The exploitation vector involves sending maliciously crafted HTTP requests to the affected component. Due to insufficient validation or handling of input data related to database application table operations, the system fails to properly restrict access or sanitize commands before processing them against the backend identity store. This lack of proper security controls leads to a state where an authenticated high-privileged user can manipulate the connector's behavior beyond its intended scope. The ability to take over the Oracle Identity Manager Connector implies that the attacker gains the same level of control as the service account running the connector, which typically possesses extensive permissions within the identity management infrastructure and potentially broader enterprise systems depending on how privileges are mapped.
The operational impact of this vulnerability is severe, aligning with a CVSS 3.1 Base Score of 7.2, indicating a High severity rating. The vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) highlights that while the attack requires high privileges and network access, it involves low complexity and no user interaction, resulting in high impacts on confidentiality, integrity, and availability. A successful exploitation could lead to unauthorized disclosure of sensitive identity data, such as credentials or personal identifiable information stored within the connected directories. Furthermore, an attacker with takeover capabilities can modify authentication policies, alter role assignments, or disable security controls, thereby compromising the integrity of the entire identity governance framework. In a worst-case scenario, this could facilitate lateral movement across the network if the connector has access to other critical systems, leading to widespread availability issues and potential data exfiltration.
This vulnerability maps directly to CWE-269, which describes Improper Privilege Management, as it involves an actor with elevated privileges performing actions that compromise system integrity beyond expected boundaries. It also aligns with ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials and high-level permissions to maintain persistence or escalate their influence within the environment. The exploitation via HTTP further relates to CWE-20, Improper Input Validation, suggesting that the application fails to adequately verify data received from network sources before processing it against database tables.
To mitigate this risk, organizations running Oracle Fusion Middleware versions 12.2.1.4.0 or 14.1.2.1.0 must apply the latest security patches provided by Oracle immediately. It is crucial to ensure that all instances of the Identity Manager Connector are updated to a version where this flaw has been remediated. In addition to patching, administrators should enforce strict network segmentation policies to limit HTTP access to only trusted management networks and implement robust authentication mechanisms for any remaining high-privileged accounts. Regular auditing of privileged account usage and monitoring for anomalous activity within the identity management logs can help detect potential exploitation attempts early. Furthermore, adopting a principle of least privilege across all connected systems ensures that even if such a vulnerability is exploited in other components, the blast radius remains contained by restricting the permissions granted to service accounts and connectors.