CVE-2026-46793: Critical severity Oracle Identity Manager Connector vulnerability
Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Database User). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Identity Manager Connector instances: block or limit HTTP access to trusted IPs via firewall/ACLs, and/or place instances behind a WAF to filter malicious HTTP requests. Isolate affected hosts from untrusted networks until a vendor fix or patch is applied.
- Operational
Assume potential compromise and perform incident-response steps: audit logs for suspicious activity, and rotate any credentials, API keys, or service accounts used by Identity Manager Connector that may have been exposed prior to applying a vendor fix.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46793?
CVE-2026-46793 has a critical severity rating of 9.9.
How do I fix CVE-2026-46793?
To mitigate CVE-2026-46793, ensure that you update to the latest patched version of Oracle Identity Manager Connector.
Who is affected by CVE-2026-46793?
CVE-2026-46793 affects users of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0.
What type of attack can exploit CVE-2026-46793?
CVE-2026-46793 can be exploited by a low privileged attacker with network access via HTTP.
What components are involved in CVE-2026-46793?
CVE-2026-46793 involves the Database User component of the Identity Manager Connector product in Oracle Fusion Middleware.