CVE-2026-35294: Critical severity Oracle Identity Manager Connector vulnerability
Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Mainframe Connectors). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Identity Manager Connector (Oracle Fusion Middleware - Mainframe Connectors)from your environment.Uninstall or remove the Identity Manager Connector from systems where it is not required to eliminate the attack surface.
- Configuration
Disable HTTP access to the Identity Manager Connector if not required; if HTTP is required, restrict or remove exposure by binding the service to internal interfaces and limiting listeners to trusted networks only.
Identity Manager Connector (Oracle Fusion Middleware - Mainframe Connectors) HTTP access = disabled or restricted - Compensating control
Restrict network access to the Identity Manager Connector's HTTP port(s) using firewall rules, ACLs, or network segmentation so only trusted management hosts/networks can reach it; block access from the public internet.
- Operational
If compromise is suspected or confirmed, assume takeover: isolate affected hosts, perform incident response, rotate potentially exposed credentials, and restore services from known-good backups after remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35294?
CVE-2026-35294 has a critical severity rating of 9.9.
How do I fix CVE-2026-35294?
To fix CVE-2026-35294, upgrade to the latest version of the Oracle Identity Manager Connector.
What products are affected by CVE-2026-35294?
CVE-2026-35294 affects the Oracle Identity Manager Connector product within Oracle Fusion Middleware.
What types of attacks can exploit CVE-2026-35294?
CVE-2026-35294 can allow a low privileged attacker with network access via HTTP to compromise the Identity Manager.
What versions of Oracle Identity Manager are vulnerable to CVE-2026-35294?
The vulnerable versions are 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Identity Manager.