What is the CVSS score of CVE-2026-34285?

CVE-2026-34285 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle Identity Manager are affected by CVE-2026-34285?

Oracle Identity Manager Connector 12.2.1.4.0 contains a CRITICAL unauthenticated remote access vulnerability (CVSS 9.1) allowing attackers to read, create, delete, and modify connector-accessible…

How to fix or mitigate CVE-2026-34285?

Within 24 hours: Identify and inventory all systems running Oracle Identity Manager Connector 12.2.1.4.0 in your environment and restrict network access to these connectors where operationally feasible. Within 7 days: Contact Oracle Support for patch status and guidance; implement network segmentation and Web Application Firewall (WAF) rules to limit HTTPS access to known legitimate sources only. Within 30 days: Continue monitoring Oracle Security Advisories for patch availability; develop and test an upgrade plan to patched versions of Oracle Fusion Middleware and establish quarterly vulnerability scanning specifically targeting identity management components.

Oracle Identity Manager CVE-2026-34285

EUVD-2026-24368 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-04-21 oracle

GHSA-w2j6-p7c6-6cpj

Authentication Bypass Oracle Oracle Identity Manager Connector Oracle Corporation

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated network HTTPS access with no user interaction (CWE-306 missing auth) yields AV:N/AC:L/PR:N/UI:N; high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:22 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24368

CVE Published

Apr 21, 2026 - 20:35 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core component) allows a remote attacker to reach the connector over HTTPS with no credentials and read, create, delete, or modify all connector-accessible data. Mapped to CWE-306 (Missing Authentication) and tagged as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 (C:H/I:H). There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), but CISA SSVC rates it automatable with total technical impact.

Technical ContextAI

Oracle Identity Manager (OIM) Connectors are integration components of Oracle Fusion Middleware that bridge OIM's identity governance engine with external target systems (directories, databases, HR systems, cloud apps) to provision and reconcile accounts. The flagged CPE is cpe:2.3:a:oracle_corporation:oracle_identity_manager_connector, Core component. The root cause is CWE-306, Missing Authentication for a Critical Function: a network-reachable connector function or endpoint performs sensitive identity data operations without verifying the caller's identity. Because connectors mediate account creation and modification across downstream systems, missing authentication on such an interface exposes privileged identity data and lifecycle operations directly to the network.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of April 2026 (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpuapr2026.html; Oracle CPUs are cumulative, so applying the latest CPU patch for Oracle Identity Manager Connector 12.2.1.4.0 is the primary and authoritative fix. Oracle does not publish an exact fixed build string in the alert index, so treat the April 2026 CPU as the required patch level and follow the version-specific patch numbers listed in the advisory. As compensating controls until patching, restrict network reachability of the connector's HTTPS endpoint to trusted management networks or a jump host and place it behind a WAF or reverse proxy that enforces authentication, since the flaw is unauthenticated over the network - the trade-off is that legitimate provisioning/reconciliation integrations must be re-allowlisted and may break if they traverse the blocked path. Also monitor connector logs for anomalous account create/delete/modify activity as a detective control. Avoid exposing OIM or its connectors to the internet.