Identity Manager Connector CVE-2026-34289

The attacker must have network access to the Oracle Identity Manager Connector's HTTPS service port and must satisfy the conditions imposed by AC:H - the vendor characterizes this as 'difficult to exploit,' implying the attack is not reliably reproducible against all instances without meeting specific timing, configuration, or protocol preconditions (the exact nature of which Oracle has not publicly disclosed). The CVSS vector confirms PR:N, meaning no credentials or session token are required to initiate the attack. UI:N confirms no victim interaction is needed. Limiting factors include: (1) AC:H substantially reduces reliable exploitation, requiring conditions beyond simple network connectivity; (2) the affected version is fixed at 12.2.1.4.0, limiting scope to unpatched deployments of that exact release; (3) impact is confined to confidentiality - there is no integrity or availability component, limiting the immediate blast radius. Organizations that have network-segmented their OIM connector infrastructure from untrusted networks significantly reduce exploitability in practice.

The vendor-reported CVSS 3.1 score of 5.9 (Medium) reflects a meaningful but constrained risk profile: AV:N and PR:N confirm network reach and no credential requirement, but AC:H substantially limits exploitability in practice. EPSS at 0.03% in the 9th percentile independently corroborates that automated or widespread exploitation is unlikely. SSVC signals reinforce this: exploitation status is 'none,' the vulnerability is not automatable, and technical impact is rated 'partial' rather than 'total.' The vulnerability is not listed in CISA KEV, and no POC has been identified, meaning there is no confirmed weaponized exploit. The product affected is an enterprise identity connector - a sensitive target (identity data is high-value) - but the narrow deployment base and high attack complexity together push operational priority below the raw CVSS headline. The primary risk scenario is targeted intrusion by a motivated attacker with pre-existing network positioning, not opportunistic mass scanning. No conflicting signals were detected between data sources; all indicators consistently describe a real but low-probability exploitation risk.

An attacker with network-level access to the Oracle Identity Manager Connector's HTTPS interface - such as an internal threat actor or an external attacker who has already gained a foothold inside the network perimeter - sends specially crafted HTTPS requests to the Core component endpoint, bypassing the missing authentication gate under the specific conditions required by the high attack complexity. Upon successful bypass, the attacker retrieves sensitive identity governance data including user accounts, entitlements, and provisioning records managed by the connector. No public exploit code is known at time of analysis, so exploitation would currently require independent research into the missing authentication logic.