CVE-2026-46794: Critical severity Oracle Identity Manager Connector vulnerability
Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via SSH to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If SSH is not required for normal operation, disable SSH access on the Identity Manager Connector; otherwise restrict SSH to a dedicated management network or specific trusted IP addresses.
Identity Manager Connector (Generic Unix Connector) SSH access = disabled or restricted - Compensating control
Restrict network access to the Identity Manager Connector by firewall/ACLs to only trusted hosts and management networks; block or limit inbound SSH from untrusted networks.
- Compensating control
Segment and isolate the Identity Manager Connector from other production systems to limit scope change and potential impact to additional products.
- Operational
Monitor logs and network connections for suspicious SSH activity against the Identity Manager Connector and, if compromise is suspected, isolate the affected system(s) for investigation and remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46794?
CVE-2026-46794 has a critical severity rating of 9.9.
How do I fix CVE-2026-46794?
To fix CVE-2026-46794, update the Oracle Identity Manager Connector to the latest patched version.
What systems are affected by CVE-2026-46794?
CVE-2026-46794 affects Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0.
What type of attack can exploit CVE-2026-46794?
CVE-2026-46794 can be exploited by a low privileged attacker with network access via SSH.
What components are involved in CVE-2026-46794?
CVE-2026-46794 involves the Identity Manager Connector component of Oracle Fusion Middleware.