Oracle Identity Manager CVE-2026-34286

Exploitation requires network access to the Oracle Identity Manager Connector's HTTPS-exposed Core function on a deployment running version 12.2.1.4.0; per the CVSS vector (PR:N/UI:N/AC:L) no credentials, user interaction, or special configuration are needed against an affected instance. The practical limiting factor is reachability: OIM is typically an internal identity-governance system, so exploitation depends on the attacker being able to reach the connector endpoint (LAN foothold, VPN, or a misconfigured internet-facing deployment). Version is the hard gate - only 12.2.1.4.0 is listed as affected - and there is no confirmed active exploitation or public POC constraining or enabling real-world use.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) describes an easy, network, unauthenticated attack with high confidentiality and integrity impact but no availability impact - consistent with a data-exposure/tampering authentication bypass rather than remote code execution. Signals conflict on urgency: CISA SSVC rates Technical Impact as 'total' and Automatable as 'yes' (which favors prioritization), yet Exploitation is 'none', EPSS is only 0.03% (9th percentile), and there is no KEV listing or public POC. The realistic read is a genuinely severe-if-reached vulnerability whose real-world exploitation is currently low/unproven - likely because OIM is an internal enterprise system not typically internet-exposed, making mass exploitation improbable but targeted attacks against reachable deployments credible. This is a real patch priority for anyone running 12.2.1.4.0, but the low EPSS and 'Exploitation: none' status argue it is not yet an emergency compared to KEV-listed bugs.

An attacker with network access to the OIM connector's HTTPS interface sends crafted requests directly to the unauthenticated Core function, bypassing login entirely. Because CVSS is AV:N/AC:L/PR:N, they can then read sensitive identity data and create, delete, or modify accounts across all connector-accessible data with a single low-complexity request and no user interaction. No public exploit code is currently identified, but SSVC flags the attack as automatable, so a working exploit could be scripted broadly once developed.