Oracle Identity Manager Connector 12.2.1.4.0/14.1.2.1.0 Database User privilege escalation

Summaryinfo

A vulnerability was found in Oracle Identity Manager Connector 12.2.1.4.0/14.1.2.1.0. It has been classified as very critical. This affects an unknown function of the component Database User. The manipulation leads to Remote Privilege Escalation. This vulnerability is documented as CVE-2026-46793. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Oracle Identity Manager Connector 12.2.1.4.0/14.1.2.1.0. This issue affects an unknown code block of the component Database User. The manipulation with an unknown input leads to a remote privilege escalation vulnerability. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Database User). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

The advisory is shared at oracle.com. The identification of this vulnerability is CVE-2026-46793 since 05/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/17/2026).

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Oracle

Name

• Identity Manager Connector

Version

• 12.2.1.4.0
• 14.1.2.1.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion