Oracle Identity Manager Connector CVE-2026-34288

Network access via HTTP to the Oracle Identity Manager Connector 12.2.1.4.0 Core component is required. The CVSS vector (PR:N) confirms no authentication is needed from the attacker's side. However, AC:H indicates that exploitation is not straightforward against default configurations - Oracle describes this as 'difficult to exploit,' implying an undisclosed prerequisite such as a specific request timing, listener state, or protocol sequence that the attacker must induce or wait for. Exploitation is limited by: (1) high attack complexity preventing automated/mass exploitation, (2) typical enterprise deployment behind internal network boundaries reducing internet-facing exposure, and (3) scope unchanged (S:U) meaning successful exploitation does not pivot to other systems beyond the connector's own data. No special attacker privileges are required, but meeting the AC:H condition is a real barrier.

The CVSS 3.1 base score of 5.9 reflects the genuine tension between a high confidentiality impact (C:H - full data exposure) and high attack complexity (AC:H) with no authentication required (PR:N). In practice, AC:H substantially lowers the exploitability ceiling: automated, internet-scale scanning is unlikely to succeed, which aligns with SSVC's 'Automatable: no' determination. The EPSS score of 0.03% (9th percentile) and SSVC 'Exploitation: none' jointly confirm no observed exploitation at time of analysis. The identity management context elevates sensitivity - Oracle Identity Manager Connector processes privileged account data - but the deployment is enterprise-internal, not public-internet-facing in typical configurations, further reducing realistic exposure. The net assessment is a medium-severity finding demanding patch prioritization in the next maintenance cycle, not emergency response.

An attacker with access to the internal network segment hosting Oracle Identity Manager Connector sends a specially crafted HTTP request to an unauthenticated connector endpoint under specific timing or sequencing conditions (AC:H). The missing authentication check (CWE-306) allows the request to succeed, returning all identity records and credential-adjacent data the connector can access - potentially exposing Active Directory accounts, HR system profiles, or privileged service accounts managed through Oracle Identity Manager. No public exploit code has been identified at time of analysis.