Loading vulnerability…
Unauthenticated Critical Data Access and Modification in Oracle Identity Manager Connector Core
CVE-2026-34286 is a critical vulnerability in the Core component of Oracle Identity Manager Connector, part of Oracle Fusion Middleware. The affected supported version is 12.2.1.4.0. The flaw is remotely exploitable over HTTPS by an unauthenticated attacker and requires no user interaction. Successful exploitation allows compromise of the connector’s accessible data set, including unauthorized access to critical data and the ability to create, delete, or modify critical data. Publicly available vendor metadata does not disclose the exact vulnerable function or implementation detail, but the attack profile and impact are consistent with missing or improperly enforced authentication on exposed Core functionality.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in high confidentiality and high integrity impact. An attacker can obtain unauthorized access to critical data, potentially extending to complete access to all data accessible through Oracle Identity Manager Connector, and can also create, delete, or modify that data without authorization. The CVSS vector indicates no direct availability impact, making the vulnerability particularly dangerous for silent manipulation of identity-related records and workflows rather than service disruption.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to the Oracle Identity Manager Connector HTTPS interface to only trusted administrative or application systems, and remove unnecessary external exposure. Monitor for anomalous identity-data access and unexpected create, modify, or delete operations affecting connector-managed records. Interim controls should be validated carefully because access restrictions may affect dependent identity workflows.
Patch, then assume compromise.
Apply Oracle’s April 2026 Critical Patch Update for Oracle Fusion Middleware, specifically the fix for Oracle Identity Manager Connector Core in version 12.2.1.4.0. Priority should be given to externally reachable or broadly accessible deployments. Use the vendor-supplied cumulative security update rather than attempting selective or partial remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.