What is the CVSS score of CVE-2026-34289?

CVE-2026-34289 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Identity Manager Connector CVE-2026-34289

EUVD-2026-24373 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-21 oracle

GHSA-jqm5-j7h7-59w8

Authentication Bypass Oracle Oracle Identity Manager Connector Oracle Corporation

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network HTTPS attack requiring no credentials per CWE-306 auth bypass; AC:H reflects vendor-stated exploitation difficulty; impact is confidentiality-only with no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:21 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24373

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 5.9

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Oracle Identity Manager Connector 12.2.1.4.0 exposes a missing authentication control (CWE-306) in its Core component, reachable over HTTPS by unauthenticated network attackers. Successful exploitation yields unauthorized read access to critical data or complete access to all data accessible by the connector - a significant confidentiality breach in an identity governance system. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) alongside SSVC's 'none' exploitation rating indicate low real-world exploitation pressure despite the network-accessible vector.

Technical ContextAI

Oracle Identity Manager Connector (CPE: cpe:2.3:a:oracle_corporation:oracle_identity_manager_connector:*:*:*:*:*:*:*:*) is an integration component within the Oracle Fusion Middleware Identity Governance stack, responsible for connecting Oracle Identity Manager (OIM) to managed target systems. The root cause is CWE-306 - Missing Authentication for Critical Function - meaning a function within the Core component does not enforce authentication before granting access to sensitive identity data. The attack transport is HTTPS, which is the standard API/connector communication channel for OIM integrations. The high attack complexity (AC:H) in the vendor's CVSS vector implies that exploitation is not straightforward against all deployments: specific timing, configuration state, or protocol-level conditions must be satisfied, consistent with race conditions or partially-protected endpoints in middleware connector frameworks.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for April 2026, which addresses this vulnerability; the advisory is published at https://www.oracle.com/security-alerts/cpuapr2026.html. A specific patched version number beyond the CPU cycle designation is not independently confirmed in the available data - consult Oracle's My Oracle Support (MOS) for exact patch IDs and installation instructions applicable to your OIM environment. If immediate patching is not feasible, compensating controls should focus on network segmentation: restrict HTTPS access to the Oracle Identity Manager Connector's Core component endpoints to authorized identity governance hosts and administrative networks only, reducing the attacker's ability to reach the unauthenticated endpoint. Disabling or temporarily taking offline any externally exposed OIM connector endpoints is an additional mitigation with the trade-off of interrupting provisioning workflows. Monitor HTTPS access logs to the connector component for anomalous unauthenticated request patterns as a detection control.