What is the CVSS score of CVE-2026-34288?

CVE-2026-34288 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Oracle Identity Manager Connector CVE-2026-34288

EUVD-2026-24371 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-21 oracle

GHSA-j4r5-x8vx-whv5

Authentication Bypass Oracle Oracle Identity Manager Connector Oracle Corporation

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network HTTP vector confirmed; AC:H matches Oracle's 'difficult to exploit' characterization; PR:N per unauthenticated access; only confidentiality impacted per description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:21 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24371

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 5.9

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated network access to Oracle Identity Manager Connector 12.2.1.4.0 enables complete confidentiality compromise of all data accessible by the connector via an authentication bypass in its Core component. The flaw (CWE-306, Missing Authentication for Critical Function) is reachable over HTTP without credentials but carries high attack complexity, constraining exploitation to actors capable of meeting undisclosed preconditions. No active exploitation has been identified - EPSS sits at the 9th percentile (0.03%) and CISA SSVC rates it as non-automatable with partial technical impact - suggesting limited near-term risk despite the identity management context.

Technical ContextAI

Oracle Identity Manager Connector (CPE: cpe:2.3:a:oracle_corporation:oracle_identity_manager_connector:*:*:*:*:*:*:*:*) is a provisioning bridge within Oracle Fusion Middleware's Identity Governance suite, responsible for synchronizing user accounts and credentials between Oracle Identity Manager and external target systems (e.g., LDAP directories, HR platforms). CWE-306 (Missing Authentication for Critical Function) indicates that a specific HTTP-accessible function - likely a connector endpoint or API surface - does not enforce an authentication check before processing requests, allowing an unauthenticated caller to retrieve the full dataset the connector can access. The AV:N/AC:H pairing in the CVSS vector suggests the bypass is not trivially reachable: some undisclosed network-level or timing condition must be satisfied, potentially a race condition, specific request sequencing, or a particular listener configuration.

RemediationAI

Apply the Oracle Critical Patch Update for April 2026, which addresses CVE-2026-34288 for Oracle Identity Manager Connector 12.2.1.4.0; the advisory is available at https://www.oracle.com/security-alerts/cpuapr2026.html. No exact patched version number is confirmed in the available data - consult the CPU documentation for the precise artifact version to deploy. As a compensating control pending patching, restrict network access to the connector's HTTP listener to only the Oracle Identity Manager host and authorized provisioning servers via firewall or network ACLs; this reduces the pool of attackers who can satisfy the network-access prerequisite. Note that firewall segmentation does not eliminate the vulnerability if the connector is legitimately accessible from internal networks where an adversary has a foothold.