EUVD-2026-24370
GHSA-g233-f2vv-qw6j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach connector HTTPS endpoint over network
-
DeliverySend crafted unauthenticated request
-
ExploitBypass access control in Core
-
ExecutionInvoke privileged connector operations
-
ImpactRead or modify identity/account data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle Identity Manager Connector's HTTPS interface (Core component) on version 12.2.1.4.0; per CVSS AV:N/AC:L/PR:N/UI:N this is unauthenticated remote exploitation with no user interaction and low complexity against the affected connector. The primary limiting factor is exposure: the connector's HTTPS endpoint must be reachable by the attacker, so deployments that keep OIM connectors on isolated internal/management networks substantially reduce real-world exploitability. Impact is confined to data the connector can access (C:H/I:H) and does not affect availability (A:N). The specific vulnerable feature within Core is not detailed in the available data beyond the improper-access-control (authentication bypass) classification. |
| Impact | The signals partially conflict, so prioritize carefully. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N) and SSVC (Automatable: yes, Technical Impact: total) both indicate a trivially exploitable, high-impact, remotely reachable flaw - a strong argument for urgent remediation. However, EPSS is only 0.03% (9th percentile) and SSVC exploitation status is 'none', and the CVE is not in CISA KEV - meaning no observed or public exploitation yet. This is a classic high-CVSS / low-current-exploitation profile: the theoretical risk is severe (total compromise of identity data with no auth), but real-world weaponization has not materialized. Given that a compromised identity-management connector can lead to unauthorized account creation/modification across an enterprise, the potential blast radius justifies treating it as a real priority for patching even though live exploitation is not yet evidenced. Note availability is unaffected (A:N), so this is a data-integrity/confidentiality risk, not a DoS. |
| Exploit ScenarioDerived | An attacker on the network sends crafted HTTPS requests directly to an exposed Oracle Identity Manager Connector endpoint and, exploiting the improper access control, invokes connector operations without any credentials. They then read sensitive identity data and create or modify accounts - for example provisioning a rogue privileged account or altering entitlements - across systems the connector governs. No public exploit code has been identified at time of analysis, and exploitation requires no user interaction given AC:L/UI:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Unauthenticated authentication-bypass and access-control weakness in Oracle Identity Manager Connector 12.2.1.4.0 (Core component of Oracle Fusion Middleware) allows a network attacker to read, create, delete, or modify any data the connector can reach over HTTPS. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, it is easily exploitable without credentials or user interaction, though EPSS is very low (0.03%) and there is no public exploit identified at time of analysis. SSVC marks technical impact as total and the flaw as automatable, so it warrants prompt patching in the April 2026 Oracle CPU despite the currently low observed exploitation.
RemediationAI
Apply the fixes from Oracle's April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html), which is the authoritative source of the patch for CVE-2026-34287; consult that advisory for the exact connector patch bundle applicable to 12.2.1.4.0, as the input does not enumerate a specific fixed version string. Until the CPU patch is applied, restrict network exposure of the Identity Manager Connector by placing it behind network segmentation and allowing HTTPS access only from trusted management hosts or via a VPN/reverse-proxy that enforces authentication (trade-off: may break legitimate integration traffic from target systems, so allow-list those endpoints explicitly). Additionally, monitor OIM audit logs for anomalous account creation, deletion, or entitlement modification as a detective control while patching is scheduled. Do not rely on workarounds as a permanent fix given the total technical impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Identity Manager (OIM) is the identity-governance and provisioning tier of Oracle Fusion Middleware; connectors are the integration modules that synchronize identities, entitlements, and account data between OIM and downstream target systems (Active Directory, databases, SaaS apps, etc.). The flaw resides in the Core component of the Connector and is classified as CWE-284 (Improper Access Control), consistent with the 'Authentication Bypass' tag - meaning the connector fails to correctly enforce authentication/authorization on network-reachable functionality. Because the connector brokers privileged provisioning operations, weak access control there exposes the identity data and account-lifecycle actions it mediates. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_identity_manager_connector, scoped to version 12.2.1.4.0.
Know when Oracle Identity Manager Connector gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network HTTPS access with low complexity and no user interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality and integrity impact but no availability effect per the authentication-bypass data-access nature.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Identity Manager Connector 12.2.1.4.0 contains a critical authentication bypass allowing any network attacker to access and modify sensitive identity and administrative data without credentials. Organizations running Oracle Fusion Middleware face potential compromise of access controls and unauthorized privilege escalation across systems dependent on identity management. Immediate network isolation and patch preparation are required despite currently low observed exploitation rates.
No vendor-released patch identified at time of analysis. Implement interim mitigations: restrict HTTPS network access via firewall to authorized internal systems only; enable detailed logging and alerting on all identity manager data operations; isolate the connector to a segregated network segment with restricted ingress and egress; monitor for anomalous access patterns. Deploy vendor patch immediately upon availability in Oracle's April 2026 Critical Patch Update.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authentication bypass in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core component) lets a
Unauthenticated data compromise in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core componen
Denial-of-service in Oracle Identity Manager Connector (Core component) version 12.2.1.4.0 lets a remote, unauthenticate
Oracle Identity Manager Connector 12.2.1.4.0 exposes a missing authentication control (CWE-306) in its Core component, r
Unauthenticated network access to Oracle Identity Manager Connector 12.2.1.4.0 enables complete confidentiality compromi
Improper access control in Oracle Identity Manager Connector 12.2.1.4.0 exposes the Microsoft Active Directory component
Exploit-DB