What is the CVSS score of CVE-2026-34294?

CVE-2026-34294 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Oracle Identity Manager Connector CVE-2026-34294

EUVD-2026-24380 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

Authentication Bypass Microsoft Oracle Oracle Identity Manager Connector Oracle Corporation

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

5.9 MEDIUM

Network exploitation via LDAP with low privilege and high complexity conditions required; high integrity impact from unauthorized directory write operations; no availability or scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:19 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24380

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 5.9

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized read access to a subset of Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Improper access control in Oracle Identity Manager Connector 12.2.1.4.0 exposes the Microsoft Active Directory component to network-based exploitation via LDAP, enabling low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a CVSS 3.1 score of 5.9 (Medium), tempered by high attack complexity (AC:H) and a near-zero EPSS of 0.03% (8th percentile). No public exploit code exists and no active exploitation has been reported; this is a real but difficult-to-trigger integrity-focused flaw in Oracle's enterprise identity management stack.

Technical ContextAI

Oracle Identity Manager Connector (OIM Connector) is an enterprise identity governance component of Oracle Fusion Middleware that synchronizes and provisions user accounts between Oracle Identity Manager and external directories, including Microsoft Active Directory, via the LDAP protocol. The affected version is 12.2.1.4.0, identified by CPE cpe:2.3:a:oracle_corporation:oracle_identity_manager_connector:*:*:*:*:*:*:*:*. The root cause is CWE-284 (Improper Access Control), meaning the connector's LDAP integration layer fails to enforce sufficient authorization checks on operations directed at Active Directory, allowing a low-privileged authenticated principal to exceed their intended permissions and perform write-level operations (create, delete, modify) on critical data objects. The AD component tag further confirms the flaw resides specifically in the connector's handling of Active Directory-bound LDAP transactions rather than the OIM core engine itself.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for April 2026, available via the Oracle Security Alerts portal at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle does not publish individual patched version numbers in CPU summaries; administrators should consult My Oracle Support and the CPU advisory for the specific patch number applicable to Oracle Identity Manager Connector 12.2.1.4.0. As a compensating control pending patching, restrict LDAP access to the OIM Connector's Active Directory integration endpoint to only explicitly authorized service accounts and privileged identity workstations via network-layer ACLs or firewall rules - this reduces the attack surface by limiting which authenticated principals can reach the vulnerable interface. Additionally, audit low-privileged OIM Connector accounts for unnecessary Active Directory write permissions and apply least-privilege scoping to connector service accounts. These controls reduce but do not eliminate risk, as the flaw is in the connector's authorization logic rather than network exposure alone.