External risk intelligence

Oracle Identity Manager Connector Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-46793

A critical vulnerability in Oracle Fusion Middleware's Identity Manager Connector could allow a low-privileged attacker with network access to take over the connector, potentially impacting other connected products. This vulnerability, easily exploitable via HTTP, poses a significant risk to confidentiality, integrity,

Halo Surface Signal

Possible · external exposure

3Halo Surface Signal

The vulnerability affects a middleware connector for Identity Manager. While it is accessible via HTTP, such connectors typically operate within internal application tiers or backend infrastructure rather than serving as public-facing edge gateways or portals. Exposure depends on specific deployment architecture, making internet reachability possible but not a standard design requirement.

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Fusion Middleware's Identity Manager Connector, an issue that could allow unauthorized access and potentially impact related products. The exploit is considered easy and requires only low privileges, posing a significant risk to confidentiality, integrity, and availability.

  • Low-privilege access to Identity Manager.
  • Potential broad impact across connected systems.
  • Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with limited privileges can exploit this vulnerability by sending network requests over HTTP to the Identity Manager Connector. This component, part of Oracle Fusion Middleware, is susceptible due to issues with its Database User handling. A successful attack could grant the attacker control over the Identity Manager Connector, potentially affecting other connected products.

  • Low-privileged attacker with network access.
  • HTTP request to Identity Manager Connector.
  • Takeover of the Identity Manager Connector.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged attacker with network access could compromise Oracle Identity Manager Connector, potentially impacting other connected products. This vulnerability could lead to the takeover of the Identity Manager Connector when supported by the advisory.

  • Identity Manager Connector and related systems.
  • Via unauthenticated network access over HTTP.
  • Full system takeover and broad data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability in Oracle Fusion Middleware's Identity Manager Connector, application owners and infrastructure teams should lead the effort. The immediate priority is to identify all instances of the affected product, confirm their network exposure and business criticality, and then assign ownership for remediation. Planning for mitigation should be risk-based, potentially involving vendor coordination or temporary controls if immediate patching is not feasible.

  • Application and infrastructure teams own remediation.
  • Verify product presence and network exposure.
  • Plan risk-based mitigation and vendor coordination.

Supplementary metadata

PCI scan relevance

Yes

CVE-2026-46793 — Halo PCI Relevance: Yes. Under typical PCI ASV external scan criteria, this issue may be flagged for scan prioritization.

This vulnerability in Oracle Fusion Middleware's Identity Manager Connector allows a low-privileged attacker to take over the system, which would likely cause a PCI ASV scan to fail.

Scan-prioritization guidance only—not a PCI DSS certification or ASV attestation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Identity Manager Connector?

It is a specialized component within Oracle Fusion Middleware designed to bridge the gap between Identity Manager and various external databases. It enables secure synchronization and management of user accounts across different systems. Organizations use it to automate how identity information flows into backend databases, ensuring that user access rights and permissions are consistently applied across their enterprise environment.

How does CVE-2026-46793 affect security?

This vulnerability is classified as Improper Access Control (CWE-284). It represents a critical flaw where the connector fails to properly restrict or verify the actions of users. Because of this, an attacker with only low-level access can bypass intended security boundaries to gain unauthorized control over the connector, leading to a complete compromise of its functions and potentially impacting the security of connected systems.

What does an attacker need to trigger this vulnerability?

An attacker must have low-privileged access to the network and the ability to send specific HTTP requests to the targeted Identity Manager Connector. It is important to note that this bug is not triggered by public browsing activity; it requires a direct, functional interaction with the connector's interface to send the malicious commands that exploit the database user handling flaw.

Do I need to worry if my systems are not internet-facing?

While Halo Surface Signal classifies this as an external threat due to the network-based attack vector, your risk depends on how your infrastructure is segmented. These connectors often reside in internal backend tiers rather than at the network edge. If your Identity Manager Connector is restricted to internal-only communication, your immediate exposure is lower, though it remains a target for lateral movement if an attacker gains an internal foothold.

How should I respond to CVE-2026-46793?

Begin by auditing your infrastructure to locate all instances of the Identity Manager Connector in versions 12.2.1.4.0 and 14.1.2.1.0. Once identified, evaluate the network accessibility of these instances and prioritize those reachable from less trusted zones. Coordinate with your application owners to plan for vendor-supplied updates and assess whether temporary network-level controls can limit access while a permanent remediation is deployed.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished