CVE-2026-46794: Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector)

Synopsis

A critical remote code execution vulnerability affects the Generic Unix Connector component of Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0). The flaw is reachable over the network via SSH and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives an attacker full control of the Identity Manager Connector instance, with spillover impact on additional systems in scope. No fix versions have been published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Identity Manager Connector service over the network via SSH; the service must be network-accessible for exploitation to proceed.

• AuthenticationRequired

  A valid account with low privileges is sufficient; no administrative or elevated credentials are required beyond a basic authenticated SSH session.

• Victim interactionNot required

  Exploitation is entirely attacker-driven; no user action, click, or approval from a legitimate user is needed.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or environmental prerequisites beyond network access and a low-privilege credential.

Blast Radius

• A successful attacker achieves full takeover of the Identity Manager Connector instance, including reading all provisioning credentials, account data, and Unix connector configuration stored by the service.
• The attacker can modify or delete identity records, connector configurations, and provisioned account mappings, corrupting downstream Unix system access controls.
• The Identity Manager Connector process and its dependent services can be crashed or made permanently unavailable, disrupting automated provisioning and de-provisioning workflows.
• Because the CVSS scope is changed, impact extends beyond the connector itself: adjacent Oracle Fusion Middleware components that trust the connector can also be compromised.