What is the CVSS score of EUVD-2026-24374?

EUVD-2026-24374 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle Identity Manager Connector are affected by EUVD-2026-24374?

Oracle Identity Manager Connector (Core) version 12.2.1.4.0 contains a remote denial-of-service vulnerability that allows unauthenticated attackers to crash or hang the service, causing complete…

How to fix or mitigate EUVD-2026-24374?

Within 24 hours, inventory all systems running Oracle Identity Manager Connector 12.2.1.4.0 and assess their criticality and network exposure to untrusted sources. Within 7 days, implement firewall rules restricting TCP access to the connector from only authorized systems, enable connection rate limiting at the network and application layers, and deploy monitoring to detect resource exhaustion patterns. Within 30 days, monitor Oracle's security advisory channels for patch availability and plan an upgrade schedule to transition to a patched version once released, prioritizing systems handling critical authentication functions.

Oracle Identity Manager Connector EUVD-2026-24374

| CVE-2026-34290 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-q23x-qvv8-gcm5

Denial Of Service Oracle Oracle Identity Manager Connector Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated TCP reachability with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is a complete DoS so A:H with C:N/I:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:20 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24374

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Identity Manager Connector. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle Identity Manager Connector (Core component) version 12.2.1.4.0 lets a remote, unauthenticated attacker send network traffic over TCP to hang or repeatedly crash the service, producing a complete availability outage (CVSS 3.1 7.5). Oracle disclosed this in the April 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and EPSS is very low (0.04%). Confidentiality and integrity are unaffected - the impact is purely availability (CWE-400, resource exhaustion).

Technical ContextAI

Oracle Identity Manager (OIM) Connectors integrate OIM - part of the Oracle Fusion Middleware identity governance stack - with external target systems to provision and reconcile user accounts. The affected element is the Core component of the connector, listening on a network-reachable TCP service. The root cause is classified as CWE-400 (Uncontrolled Resource Consumption): the connector fails to bound consumption of a finite resource (memory, threads, CPU, or connection handling) when processing attacker-supplied network input, allowing exhaustion that manifests as a hang or repeatable crash. The CPE cpe:2.3:a:oracle_corporation:oracle_identity_manager_connector:*:* identifies the affected application, with the vendor pinning the supported affected release to 12.2.1.4.0.

RemediationAI

Apply the fixes delivered in the Oracle April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html), which is the authoritative source for the exact patch/bundle applicable to Oracle Identity Manager Connector 12.2.1.4.0; a specific fixed version string was not provided in the input, so treat the CPU as 'Patch available per vendor advisory' and follow its patch matrix for OIM Connector. Because the vulnerability is remotely reachable over TCP without authentication, prioritize network-level compensating controls until patching completes: restrict TCP access to the connector's listening port so it is reachable only from trusted OIM/provisioning hosts via firewall or network ACLs (trade-off: may break legitimate integrations if the allowlist is incomplete), place the service behind a VPN or internal segment rather than exposing it to untrusted networks, and apply rate-limiting or connection throttling at a load balancer/reverse proxy to blunt resource-exhaustion attempts (trade-off: aggressive limits can impact legitimate provisioning bursts). Monitor for repeated crashes/hangs and configure service auto-restart/high-availability to reduce outage duration as an interim measure.