Loading vulnerability…
Unauthorized Data Access and Modification in Oracle Identity Manager Connector Core
CVE-2026-34285 is a critical vulnerability in the Core component of Oracle Identity Manager Connector, part of Oracle Fusion Middleware. The affected supported version is 12.2.1.4.0. The flaw is remotely exploitable over HTTPS by an unauthenticated attacker and is described as easily exploitable. Successful exploitation can allow unauthorized access to critical data or complete access to all data accessible through Oracle Identity Manager Connector, as well as unauthorized creation, deletion, or modification of critical data. The published CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating low attack complexity, no required privileges, no user interaction, and high confidentiality and integrity impact without direct availability impact. Publicly available information does not provide sufficient technical detail to reliably identify the precise vulnerable function or root cause.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of data handled by Oracle Identity Manager Connector. An attacker may gain unauthorized access to critical data or complete access to all connector-accessible data, and may also create, delete, or modify critical data without authorization. The stated impact is high for confidentiality and integrity, with no direct availability impact reflected in the CVSS assessment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to the Oracle Identity Manager Connector HTTPS interface to only trusted administrative or application sources, and remove unnecessary external exposure. Additional defensive measures include segmentation of the affected service, tight access control at upstream network boundaries, and monitoring for anomalous identity-data access or unexpected create, modify, and delete operations affecting connector-managed data. No product-specific temporary workaround beyond access restriction is clearly documented.
Patch, then assume compromise.
Apply Oracle's April 2026 Critical Patch Update for Oracle Fusion Middleware, specifically the fix for Oracle Identity Manager Connector Core in version 12.2.1.4.0. Organizations should prioritize patching internet-reachable or otherwise network-accessible deployments exposed over HTTPS and deploy the vendor-provided update through standard Oracle support channels.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.