What is the CVSS score of EUVD-2026-24364?

EUVD-2026-24364 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Oracle Identity Manager EUVD-2026-24364

| CVE-2026-34283 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-6pjm-v57q-8qfm

Authentication Bypass Oracle Oracle Identity Manager Oracle Corporation

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network HTTP delivery with no auth required; user interaction mandatory; scope change reflects OIM's integration with other Fusion Middleware; no availability impact stated.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:23 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24364

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.1

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as unauthorized read access to a subset of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Improper access control in Oracle Identity Manager's Identity Console component (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to partially compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content. The scope change designation confirms that a successful attack can cascade beyond OIM itself to additional Oracle Fusion Middleware components integrated within the same environment. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) reflects very low real-world exploitation probability.

Technical ContextAI

Oracle Identity Manager (OIM) is an enterprise identity governance and administration platform within the Oracle Fusion Middleware stack, responsible for user provisioning, role management, and access request workflows. The affected component is Identity Console, the web-based administrative UI. The root cause is classified as CWE-284 (Improper Access Control), indicating that the application fails to correctly enforce authorization boundaries - consistent with the 'Authentication Bypass' tag - potentially permitting an unauthenticated party to reach or influence protected functionality when a legitimate session holder is involved. The CVSS scope-changed (S:C) metric reflects OIM's tight integration with other Fusion Middleware products (e.g., Oracle Access Manager, SOA Suite), meaning unauthorized reads or writes within OIM can propagate into dependent systems. Affected CPE: cpe:2.3:a:oracle_corporation:oracle_identity_manager:*:*:*:*:*:*:*:*.

RemediationAI

Apply the patches provided in Oracle's Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle CPU advisories deliver cumulative patches and should be applied according to Oracle's documented patch application procedures for Fusion Middleware. An exact replacement version number was not independently confirmed in the available data - consult the CPU advisory directly for the precise patched build numbers. As a compensating control where immediate patching is not feasible, consider restricting network access to the Identity Console administrative interface using web application firewall rules or network-layer ACLs to limit exposure to trusted internal networks or VPN segments only; this reduces the effective attack surface by preventing unauthenticated external HTTP access, though it does not eliminate risk for internally-sourced attacks. Additionally, user awareness of phishing-style link delivery can reduce the likelihood of the required human interaction being triggered.