Cyber Posture

CVE-2026-34285

Critical

Published: 21 April 2026

Published
21 April 2026
Modified
23 April 2026
KEV Added
Patch
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0006 19.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34285 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Oracle Identity Manager Connector. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the vulnerability by requiring timely identification, reporting, and patching of flaws as provided in the Oracle Critical Patch Update advisory.

prevent

Limits critical functions like data creation, deletion, modification, and access that can be performed without identification or authentication, addressing CWE-306 missing authentication.

preventdetect

Controls and monitors network communications at external interfaces to block or identify unauthenticated HTTPS access to the vulnerable connector.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a missing authentication for critical function (CWE-306) in a network-accessible Oracle Identity Manager Connector component exposed via HTTPS, directly enabling unauthenticated remote exploitation to access and manipulate critical data.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager Connector. Successful…

more

attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Deeper analysisAI

CVE-2026-34285 is a vulnerability in the Core component of the Oracle Identity Manager Connector product within Oracle Fusion Middleware. The supported version affected is 12.2.1.4.0. This easily exploitable issue carries a CVSS 3.1 base score of 9.1, with impacts to confidentiality and integrity but no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). It is associated with CWE-306 (Missing Authentication for Critical Function).

An unauthenticated attacker with network access via HTTPS can exploit this vulnerability to compromise the Oracle Identity Manager Connector. Successful attacks enable unauthorized creation, deletion, or modification of critical data or all Oracle Identity Manager Connector accessible data, as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data.

The Oracle Critical Patch Update advisory provides details on mitigation and patches: https://www.oracle.com/security-alerts/cpuapr2026.html.

Details

CWE(s)

Affected Products

oracle
identity manager connector
12.2.1.4.0

CVEs Like This One

CVE-2026-34286Same product: Oracle Identity Manager Connector
CVE-2026-34287Same product: Oracle Identity Manager Connector
CVE-2025-21535Same vendor: Oracle
CVE-2025-61757Same vendor: Oracle
CVE-2025-53037Same vendor: Oracle
CVE-2026-34279Same vendor: Oracle
CVE-2026-21992Same vendor: Oracle
CVE-2025-21524Same vendor: Oracle
CVE-2025-21515Same vendor: Oracle
CVE-2026-34290Same product: Oracle Identity Manager Connector

References