CVE-2026-46792: Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector)

Synopsis

This is a critical-severity vulnerability affecting Oracle Identity Manager Connector (Generic Unix Connector component), versions 12.2.1.4.0 and 14.1.2.1.0. An attacker with a low-privilege account and HTTP network access can exploit this flaw without any victim interaction, achieving full takeover of the connector service including confidentiality, integrity, and availability impacts that extend beyond the connector itself to additional products in the environment (a CVSS scope change). No upstream fix version has been published as of the CVE record date; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Identity Manager Connector service over the network via HTTP; there is no local or physical access requirement.

• AuthenticationRequired

  A low-privilege account is sufficient; any valid authenticated user on the network can initiate the attack, but unauthenticated access alone does not trigger the flaw.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker operates entirely on their own without involving a victim.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental factors to succeed.

Blast Radius

• A successful attacker gains full read access to all data handled by the connector, including stored credentials, Unix account mappings, and identity provisioning records.
• The attacker can modify or delete provisioned Unix account configurations and identity data persisted by the connector, corrupting downstream provisioning workflows.
• The connector service can be crashed or made permanently unavailable, halting identity provisioning operations that depend on it.
• Because the CVSS scope change applies, the impact propagates to additional Oracle Fusion Middleware products sharing the environment, expanding attacker reach beyond the connector itself.