CVE-2026-35294: Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Mainframe Connectors)

Synopsis

A critical-severity flaw in Oracle Identity Manager Connector (Mainframe Connectors component), affecting versions 12.2.1.4.0 and 14.1.2.1.0, allows a low-privileged attacker to reach the service over HTTP and fully compromise the product. Successful exploitation gives the attacker complete control over Identity Manager Connector, with confirmed scope change meaning the impact spills into other connected systems beyond the directly attacked product. No fix versions have been published by Oracle as of this record; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment Oracle ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Identity Manager Connector service over the network via HTTP; no physical or local access is needed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials, but unauthenticated access alone is not enough.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker exploits the service directly.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable with no race conditions or special environmental prerequisites required.

Blast Radius

• A successful attacker reads all data managed by Identity Manager Connector, including identity records, credentials, and mainframe account mappings.
• The attacker writes to or modifies identity and account data, enabling privilege escalation, account takeover, or fraudulent provisioning across connected mainframe systems.
• The attacker crashes or makes Identity Manager Connector unavailable, disrupting authentication and provisioning workflows for dependent systems.
• Because the CVSS scope is changed, the compromise extends beyond Identity Manager Connector itself into other Oracle Fusion Middleware products and systems that trust it for identity decisions.