CVE-2026-35294 Overview
CVE-2026-35294 is a critical access control vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware, specifically affecting the Mainframe Connectors subcomponent. The flaw allows a low-privileged attacker with network access via HTTP to fully compromise the Identity Manager Connector. The vulnerability has a scope change, meaning successful exploitation can impact resources beyond the vulnerable component itself. Affected versions include Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0. Oracle published the advisory as part of its June 2026 Critical Patch Update cycle.
Critical Impact
Successful exploitation results in full takeover of the Identity Manager Connector with high impact to confidentiality, integrity, and availability across connected systems.
Affected Products
- Oracle Identity Manager Connector 12.2.1.4.0
- Oracle Identity Manager Connector 14.1.2.1.0
- Oracle Fusion Middleware Mainframe Connectors component
Discovery Timeline
- 2026-06-17 - CVE CVE-2026-35294 published to NVD
- 2026-06-17 - Last updated in NVD database
- June 2026 - Oracle releases Critical Patch Update addressing CVE-2026-35294
Technical Details for CVE-2026-35294
Vulnerability Analysis
The vulnerability resides in the Mainframe Connectors component of Oracle Identity Manager Connector, a product responsible for synchronizing identity data between Oracle Identity Manager and mainframe-based identity stores. The flaw is categorized under [CWE-284] Improper Access Control. An authenticated attacker with low privileges can issue crafted HTTP requests to the connector and bypass intended access restrictions. The CVSS scope change indicates the vulnerable component can grant the attacker authority over additional downstream products, including any identity targets the connector synchronizes with. Successful exploitation yields complete takeover of the connector and exposes propagated credentials, provisioning workflows, and identity attributes.
Root Cause
The root cause is improper enforcement of access control checks on HTTP-reachable connector functionality. The Mainframe Connectors subcomponent fails to validate that the authenticated principal possesses sufficient authorization to invoke privileged operations. This allows a low-privileged caller to reach functions that should be restricted to administrative roles. See the Oracle Security Alert for vendor-supplied technical context.
Attack Vector
Exploitation requires only network access over HTTP and valid low-privilege credentials. No user interaction is needed and the attack complexity is low. Because the connector brokers identity provisioning to mainframe systems, an attacker who takes over the connector can pivot to issue provisioning commands, harvest credentials in transit, or modify identity attributes on connected systems. The scope change reflects this lateral impact path beyond the connector itself.
No public proof-of-concept code is available at the time of publication.
Detection Methods for CVE-2026-35294
Indicators of Compromise
- Unexpected HTTP requests to Identity Manager Connector endpoints originating from low-privileged or service accounts.
- Anomalous provisioning, deprovisioning, or attribute-modification events on mainframe identity targets that do not correspond to approved change tickets.
- New or modified administrative role assignments within Oracle Identity Manager outside of scheduled workflows.
- Authentication anomalies such as repeated successful logins from low-privileged accounts followed by privileged connector API calls.
Detection Strategies
- Inspect Oracle Identity Manager application and audit logs for connector API invocations performed by accounts lacking the corresponding administrative entitlement.
- Correlate connector HTTP access logs with downstream mainframe RACF, ACF2, or Top Secret provisioning events to identify out-of-band changes.
- Hunt for HTTP requests targeting Mainframe Connectors endpoints with unusual user-agent strings, request rates, or parameter patterns.
Monitoring Recommendations
- Forward Oracle Identity Manager, WebLogic, and connector logs to a centralized log platform with retention sufficient for forensic review.
- Alert on privilege changes, new administrative role grants, and bulk provisioning operations executed through the connector.
- Monitor mainframe security event feeds for identity changes initiated by the connector service account outside business hours.
How to Mitigate CVE-2026-35294
Immediate Actions Required
- Apply the Oracle June 2026 Critical Patch Update to Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 without delay.
- Restrict network access to connector HTTP endpoints to trusted management subnets only.
- Audit accounts that hold any privileges on Oracle Identity Manager and remove unused or dormant low-privileged accounts that could be abused as a foothold.
- Rotate credentials used by the connector to authenticate to mainframe identity stores after patching.
Patch Information
Oracle has released fixes as part of the June 2026 Critical Patch Update. Customers must apply the patches referenced in the Oracle Security Alert to both supported versions. No vendor-approved workaround replaces the patch.
Workarounds
- Place the connector behind a reverse proxy or web application firewall that enforces strict authentication and request filtering for connector URIs.
- Disable the Mainframe Connectors component if it is not in active use until patching is complete.
- Enforce network segmentation so only the Oracle Identity Manager server can reach the connector HTTP listener.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
