What is the CVSS score of CVE-2026-34290?

CVE-2026-34290 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-34290?

Within 24 hours, inventory all systems running Oracle Identity Manager Connector 12.2.1.4.0 and assess their criticality and network exposure to untrusted sources. Within 7 days, implement firewall rules restricting TCP access to the connector from only authorized systems, enable connection rate limiting at the network and application layers, and deploy monitoring to detect resource exhaustion patterns. Within 30 days, monitor Oracle's security advisory channels for patch availability and plan an upgrade schedule to transition to a patched version once released, prioritizing systems handling critical authentication functions.

Oracle Identity Manager Connector CVE-2026-34290

EUVD-2026-24374 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-q23x-qvv8-gcm5

Denial Of Service Oracle Oracle Identity Manager Connector Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach connector TCP service over network
Delivery

Send crafted/malformed requests
Exploit

Trigger uncontrolled resource consumption (CWE-400)
Execution

Exhaust memory/threads/CPU
Persist

Hang or crash Core component
Impact

Sustain complete denial of service

Vulnerability Assessment

Weakness	CWE CWE-400 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource consumption limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The connector's Core TCP service must be network-reachable from the attacker; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation over TCP against Oracle Identity Manager Connector 12.2.1.4.0 with no user interaction. The primary limiting factors are deployment-based rather than configuration-based: exploitation requires TCP network access to the affected service (so segmentation, firewalls, or internal-only exposure materially reduce reachability) and the target must be running the specific affected version 12.2.1.4.0. Impact is limited to availability (denial of service) only - no confidentiality or integrity compromise is possible through this flaw.
Impact	Signals are internally consistent but point to moderate real-world urgency rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) indicates trivially reachable, unauthenticated, no-interaction exploitation, but the impact is confined to availability - no data compromise. CISA SSVC reinforces this nuance: Exploitation state 'none' (no observed or public exploitation), Automatable 'yes' (the DoS can be scripted and repeated), and Technical Impact 'partial' (not a full system takeover). EPSS is very low at 0.04% (12th percentile), and there is no KEV listing and no public exploit identified at time of analysis, so this is not evidence of imminent mass exploitation. Net: a genuine availability risk worth patching on Oracle's CPU cadence, especially for internet-exposed or high-availability OIM deployments, but it is not a code-execution or data-breach threat and does not warrant out-of-band emergency response absent exposure-specific concerns.
Exploit ScenarioDerived	An attacker with network reachability to the connector's TCP service sends a stream of crafted or malformed requests that trigger uncontrolled resource consumption in the Core component, causing the connector to hang or crash. Because no authentication or user interaction is required and the effect is repeatable, the attacker can script the requests to keep the identity provisioning service continuously offline. No public exploit code has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Denial-of-service in Oracle Identity Manager Connector (Core component) version 12.2.1.4.0 lets a remote, unauthenticated attacker send network traffic over TCP to hang or repeatedly crash the service, producing a complete availability outage (CVSS 3.1 7.5). Oracle disclosed this in the April 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and EPSS is very low (0.04%). Confidentiality and integrity are unaffected - the impact is purely availability (CWE-400, resource exhaustion).

RemediationAI

Apply the fixes delivered in the Oracle April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html), which is the authoritative source for the exact patch/bundle applicable to Oracle Identity Manager Connector 12.2.1.4.0; a specific fixed version string was not provided in the input, so treat the CPU as 'Patch available per vendor advisory' and follow its patch matrix for OIM Connector. Because the vulnerability is remotely reachable over TCP without authentication, prioritize network-level compensating controls until patching completes: restrict TCP access to the connector's listening port so it is reachable only from trusted OIM/provisioning hosts via firewall or network ACLs (trade-off: may break legitimate integrations if the allowlist is incomplete), place the service behind a VPN or internal segment rather than exposing it to untrusted networks, and apply rate-limiting or connection throttling at a load balancer/reverse proxy to blunt resource-exhaustion attempts (trade-off: aggressive limits can impact legitimate provisioning bursts). Monitor for repeated crashes/hangs and configure service auto-restart/high-availability to reduce outage duration as an interim measure.

Affected VersionsENISA

Oracle Identity Manager Connector 12.2.1.4.0

Affected Packages

euvd oracle_identity_manager_connector no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Identity Manager (OIM) Connectors integrate OIM - part of the Oracle Fusion Middleware identity governance stack - with external target systems to provision and reconcile user accounts. The affected element is the Core component of the connector, listening on a network-reachable TCP service. The root cause is classified as CWE-400 (Uncontrolled Resource Consumption): the connector fails to bound consumption of a finite resource (memory, threads, CPU, or connection handling) when processing attacker-supplied network input, allowing exhaustion that manifests as a hang or repeatable crash. The CPE cpe:2.3:a:oracle_corporation:oracle_identity_manager_connector:*:* identifies the affected application, with the vendor pinning the supported affected release to 12.2.1.4.0.

Know when Oracle Identity Manager Connector gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Remote unauthenticated TCP reachability with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is a complete DoS so A:H with C:N/I:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Identity Manager Connector. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive ViewAI

Why It Matters

Oracle Identity Manager Connector (Core) version 12.2.1.4.0 contains a remote denial-of-service vulnerability that allows unauthenticated attackers to crash or hang the service, causing complete availability outages. No vendor patch is currently available, leaving affected organizations in a window of heightened risk. Immediate compensating controls are required to reduce exposure while awaiting patch release.

Business Impact: High

Compensating Controls

Restrict inbound TCP access via firewall to only authorized internal systems and networks; implement connection rate limiting and timeout configurations on network infrastructure; deploy traffic monitoring and alerting for anomalous connection patterns; if operationally feasible, isolate the service to a dedicated network segment with strict ingress controls.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Prevalence

Low

niche enterprise identity-governance connector, limited to specific Oracle OIM deployments

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.