What is the CVSS score of CVE-2026-34286?

CVE-2026-34286 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle Identity Manager are affected by CVE-2026-34286?

Oracle Identity Manager Connector 12.2.1.4.0 contains a critical authentication bypass vulnerability (CVSS 9.1) allowing unauthenticated remote attackers to read, create, delete, and modify all…

How to fix or mitigate CVE-2026-34286?

Within 24 hours, inventory all Oracle Fusion Middleware instances running Identity Manager Connector 12.2.1.4.0 and immediately restrict network access to this component from untrusted networks. Within 7 days, implement firewall rules permitting only authorized administrative systems to reach the connector, enable detailed audit logging on all connector data access, and establish a vendor contact point with Oracle for patch timeline. Within 30 days, prepare an upgrade plan to migrate to a patched connector version once released; evaluate interim disabling of the connector if operationally feasible, or implement an authentication proxy layer to add access controls in front of the vulnerable connector.

Oracle Identity Manager CVE-2026-34286

EUVD-2026-24369 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-04-21 oracle

GHSA-jg6g-fp64-wgx2

Authentication Bypass Oracle Oracle Identity Manager Connector Oracle Corporation

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Network-reachable connector function with missing authentication (PR:N, AC:L) exposing full read/modify of identity data (C:H/I:H); no availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:22 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24369

CVE Published

Apr 21, 2026 - 20:35 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Authentication bypass in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core component) lets a remote, unauthenticated attacker reach and manipulate all connector-accessible data over HTTPS. Because the flaw is a missing-authentication weakness (CWE-306), an attacker can read, create, delete, or modify critical identity data with no credentials and low complexity. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), but the CVSS 9.1 and CISA SSVC 'total' technical impact rating mark it as high severity.

Technical ContextAI

Oracle Identity Manager (OIM) is Oracle Fusion Middleware's enterprise identity-governance and provisioning platform; Connectors are the integration modules that synchronize identities, accounts, and entitlements between OIM and downstream target systems (Active Directory, databases, SaaS apps, etc.). The affected component is the connector 'Core', reachable over HTTPS. The root cause is CWE-306 (Missing Authentication for a Critical Function): a security-sensitive connector function is exposed without verifying the requester's identity, so the network-facing endpoint accepts requests that should require authentication. The single CPE provided, cpe:2.3:a:oracle_corporation:oracle_identity_manager_connector:*:*:*:*:*:*:*:*, does not pin a version, but Oracle and the EUVD record scope the defect specifically to release 12.2.1.4.0.

RemediationAI

Apply the fixes from Oracle's April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html) for the affected Oracle Identity Manager Connector 12.2.1.4.0 deployment - Patch available per vendor advisory; the CPU does not publish a single semantic fix version here, so obtain the specific connector patch/bundle from Oracle Support and verify the applied level. As compensating controls until patched, restrict network reachability of the connector's HTTPS endpoints to trusted management networks or an allow-listed jump host (side effect: may break legitimate connector traffic to/from target systems and provisioning workflows, so validate integration paths first), place the OIM connector behind a reverse proxy or WAF that enforces authentication on the exposed function, and remove any internet exposure of OIM interfaces (trade-off: does not stop an insider or a foothold on the internal network). Increase logging/monitoring on connector data-access and account create/delete/modify operations to detect abuse while remediation is scheduled.