Oracle Identity Manager CVE-2026-34287

Exploitation requires network reachability to the Oracle Identity Manager Connector's HTTPS interface (Core component) on version 12.2.1.4.0; per CVSS AV:N/AC:L/PR:N/UI:N this is unauthenticated remote exploitation with no user interaction and low complexity against the affected connector. The primary limiting factor is exposure: the connector's HTTPS endpoint must be reachable by the attacker, so deployments that keep OIM connectors on isolated internal/management networks substantially reduce real-world exploitability. Impact is confined to data the connector can access (C:H/I:H) and does not affect availability (A:N). The specific vulnerable feature within Core is not detailed in the available data beyond the improper-access-control (authentication bypass) classification.

The signals partially conflict, so prioritize carefully. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N) and SSVC (Automatable: yes, Technical Impact: total) both indicate a trivially exploitable, high-impact, remotely reachable flaw - a strong argument for urgent remediation. However, EPSS is only 0.03% (9th percentile) and SSVC exploitation status is 'none', and the CVE is not in CISA KEV - meaning no observed or public exploitation yet. This is a classic high-CVSS / low-current-exploitation profile: the theoretical risk is severe (total compromise of identity data with no auth), but real-world weaponization has not materialized. Given that a compromised identity-management connector can lead to unauthorized account creation/modification across an enterprise, the potential blast radius justifies treating it as a real priority for patching even though live exploitation is not yet evidenced. Note availability is unaffected (A:N), so this is a data-integrity/confidentiality risk, not a DoS.

An attacker on the network sends crafted HTTPS requests directly to an exposed Oracle Identity Manager Connector endpoint and, exploiting the improper access control, invokes connector operations without any credentials. They then read sensitive identity data and create or modify accounts - for example provisioning a rogue privileged account or altering entitlements - across systems the connector governs. No public exploit code has been identified at time of analysis, and exploitation requires no user interaction given AC:L/UI:N.