What is the CVSS score of CVE-2026-34287?

CVE-2026-34287 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle Identity Manager are affected by CVE-2026-34287?

Oracle Identity Manager Connector 12.2.1.4.0 contains a critical authentication bypass allowing any network attacker to access and modify sensitive identity and administrative data without…

How to fix or mitigate CVE-2026-34287?

Within 24 hours, inventory all systems running Oracle Identity Manager Connector 12.2.1.4.0 and assess exposure to untrusted network sources. Within 7 days, restrict HTTPS access to this connector component to authorized internal systems only using firewall rules and deploy enhanced logging to detect unauthorized data access attempts. Within 30 days, apply the patch from Oracle's April 2026 Critical Patch Update when released; if patching delays, evaluate network isolation or architectural alternatives to minimize exposure until a fix becomes available.

Oracle Identity Manager CVE-2026-34287

EUVD-2026-24370 CRITICAL

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-g233-f2vv-qw6j

Authentication Bypass Oracle Oracle Identity Manager Connector Oracle Corporation

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated network HTTPS access with low complexity and no user interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality and integrity impact but no availability effect per the authentication-bypass data-access nature.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:21 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24370

CVE Published

Apr 21, 2026 - 20:35 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated authentication-bypass and access-control weakness in Oracle Identity Manager Connector 12.2.1.4.0 (Core component of Oracle Fusion Middleware) allows a network attacker to read, create, delete, or modify any data the connector can reach over HTTPS. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, it is easily exploitable without credentials or user interaction, though EPSS is very low (0.03%) and there is no public exploit identified at time of analysis. SSVC marks technical impact as total and the flaw as automatable, so it warrants prompt patching in the April 2026 Oracle CPU despite the currently low observed exploitation.

Technical ContextAI

Oracle Identity Manager (OIM) is the identity-governance and provisioning tier of Oracle Fusion Middleware; connectors are the integration modules that synchronize identities, entitlements, and account data between OIM and downstream target systems (Active Directory, databases, SaaS apps, etc.). The flaw resides in the Core component of the Connector and is classified as CWE-284 (Improper Access Control), consistent with the 'Authentication Bypass' tag - meaning the connector fails to correctly enforce authentication/authorization on network-reachable functionality. Because the connector brokers privileged provisioning operations, weak access control there exposes the identity data and account-lifecycle actions it mediates. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_identity_manager_connector, scoped to version 12.2.1.4.0.

RemediationAI

Apply the fixes from Oracle's April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html), which is the authoritative source of the patch for CVE-2026-34287; consult that advisory for the exact connector patch bundle applicable to 12.2.1.4.0, as the input does not enumerate a specific fixed version string. Until the CPU patch is applied, restrict network exposure of the Identity Manager Connector by placing it behind network segmentation and allowing HTTPS access only from trusted management hosts or via a VPN/reverse-proxy that enforces authentication (trade-off: may break legitimate integration traffic from target systems, so allow-list those endpoints explicitly). Additionally, monitor OIM audit logs for anomalous account creation, deletion, or entitlement modification as a detective control while patching is scheduled. Do not rely on workarounds as a permanent fix given the total technical impact.