CVE-2026-46793: Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Database User)

Synopsis

A critical-severity vulnerability in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0, Database User component) allows any authenticated low-privilege user to send a crafted HTTP request over the network and fully compromise the service. The CVSS scope is marked as changed, meaning a successful attack can spill into adjacent systems beyond Identity Manager Connector itself. Successful exploitation gives the attacker full read, write, and availability control over Identity Manager Connector and potentially other products in the environment. No vendor fix has been published yet; HarborGuard is tracking the advisory and will surface patch availability as soon as Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Identity Manager Connector service over the network via HTTP; this is an over-the-network exposure with no physical access requirement.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials, but some valid account is required.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit this entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental prerequisites.

Blast Radius

• Reads all data managed by Identity Manager Connector, including stored user credentials, identity records, and connector configuration secrets.
• Modifies or deletes identity and database-user provisioning records, enabling privilege escalation or unauthorized account creation across connected systems.
• Crashes or degrades the Identity Manager Connector service, disrupting identity provisioning workflows for any system that depends on it.
• Because the CVSS scope is changed, a successful attacker can pivot to additional Oracle Fusion Middleware products or other systems that trust Identity Manager Connector.