CVE-2026-83023
HighCVSS 8.6Summary
Vulnerability in Oracle Identity Manager Connector (Core component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data or all connector data, with impact potentially extending to additional products (scope change). CVSS 3.1 Base Score 8.6.
Risk Assessment
No authentication requirement and scope change increase the risk of critical data exposure and impact on other systems. The risk is high for organizations with a publicly accessible connector.
Recommendation
Urgently apply Oracle patches for versions 12.2.1.4.0 and 14.1.2.1.0 and restrict HTTP access to the connector to trusted sources.
Other vulnerabilities in Oracle Identity Manager Connector
See all- CVE-2026-83344High
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Database Application Table). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a high privileged attacker with network access via HTTP to compromise Oracle Identity Manager Connector.
- CVE-2026-83028High
Vulnerability in Oracle Identity Manager Connector (Core component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A difficult to exploit vulnerability allows an unauthenticated attacker with access to the physical communication segment to take over Oracle Identity Manager Connector. CVSS 3.1 Base Score 7.5.
- CVE-2026-83026High
Vulnerability in Oracle Identity Manager Connector (Core component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A difficult to exploit vulnerability allows an unauthenticated attacker with access to the physical communication segment to take over the connector, and the impact may extend to additional products (scope change). CVSS 3.1 Base Score 8.3.
- CVE-2026-83025High
Vulnerability in Oracle Identity Manager Connector (Core component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via TCP to unauthorizedly create, delete or modify critical data and access all connector data, with impact potentially extending to additional products (scope change). CVSS 3.1 Base Score 8.7.
- CVE-2026-83024High
Vulnerability in Oracle Identity Manager Connector (Core component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low privileged attacker with logon access to the infrastructure where the connector executes can take over the connector. CVSS 3.1 Base Score 7.8.
- CVE-2017-10270High
A vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory) allows easy exploitation by an unauthenticated attacker with access to the infrastructure where Oracle Identity Manager Connector operates. Attacks can lead to unauthorized access to critical data and may cause system crashes.
- CVE-2026-83027Critical
Vulnerability in Oracle Identity Manager Connector (Core component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with access to the physical communication segment attached to the hardware running Oracle Identity Manager Connector can gain unauthorized access to data, including creation, deletion, and modification.
- CVE-2026-60995Critical
Vulnerability in Oracle Identity Manager Connector (component: Core) affects versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable flaw allows low privileged attacker with network access via TLS to compromise Oracle Identity Manager Connector. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-60990Critical
Vulnerability in Oracle Identity Manager Connector (component: Core) affects versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable flaw allows low privileged attacker with network access via TLS to compromise Oracle Identity Manager Connector. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-60535Critical
Vulnerability in Oracle Identity Manager Connector (PeopleSoft Applications component) allows an unauthenticated attacker to remotely take over the system via HTTP. It requires only network access and no privileges or user interaction.
Original NVD description (English source)
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).