Oracle Identity Manager Connector vulnerabilities

40 CVEs affecting Oracle Identity Manager Connector, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-83028, published 2026-09-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2022-23305, published 2022-01-18. Critical severity, CVSS 9.8. EPSS: 66.5% chance of exploitation in the next 30 days. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is…
CVE-2022-23302, published 2022-01-18. High severity, CVSS 8.8. EPSS: 63.6% chance of exploitation in the next 30 days. JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP…
CVE-2022-23307, published 2022-01-18. High severity, CVSS 8.8. EPSS: 54.4% chance of exploitation in the next 30 days. CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
CVE-2019-0222, published 2019-03-28. High severity, CVSS 7.5. EPSS: 12% chance of exploitation in the next 30 days. In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
CVE-2018-15756, published 2018-10-18. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving…
CVE-2020-24616, published 2020-08-25. High severity, CVSS 8.1. EPSS: 7.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
CVE-2020-24750, published 2020-09-17. High severity, CVSS 8.1. EPSS: 7.3% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
CVE-2026-60535, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0.…

Latest

CVE-2026-83028, published 2026-09-15. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to…
CVE-2026-83027, published 2026-09-15. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable…
CVE-2026-83026, published 2026-09-15. High severity, CVSS 8.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to…
CVE-2026-83025, published 2026-09-15. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to…
CVE-2026-83024, published 2026-09-15. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable…
CVE-2026-83023, published 2026-09-15. High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable…
CVE-2026-60998, published 2026-08-18. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory). Supported versions that are affected are 12.2.1.4.0 and …
CVE-2026-60996, published 2026-08-18. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and …
CVE-2026-60995, published 2026-08-18. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable…
CVE-2026-60994, published 2026-08-18. High severity, CVSS 7.2. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to…