Loading vulnerability…
Unauthenticated critical data access and modification in Oracle Identity Manager Connector Core
CVE-2026-34287 is a critical vulnerability in the Core component of Oracle Identity Manager Connector, part of Oracle Fusion Middleware. The affected supported version is 12.2.1.4.0. The flaw is remotely exploitable over HTTPS by an unauthenticated attacker and requires no user interaction. Successful exploitation allows compromise of Oracle Identity Manager Connector data handled by the affected component, including unauthorized access to critical data and complete access to all data accessible through the connector, as well as unauthorized creation, modification, or deletion of critical data. The published attack profile and impact indicate a likely authentication or authorization enforcement failure on exposed HTTPS-accessible functionality in the Core component.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in high-confidence compromise of confidentiality and integrity within Oracle Identity Manager Connector. An attacker can read critical identity and provisioning data, obtain complete access to connector-accessible data, and create, modify, or delete critical records without authorization. The CVSS v3.1 vector indicates high confidentiality and integrity impact with no direct availability impact, making the flaw particularly dangerous for silent manipulation of identity-related data and workflows rather than overt service disruption.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to the Oracle Identity Manager Connector HTTPS interface to only trusted administrative or application sources, and remove unnecessary external exposure. Use network segmentation and access-control enforcement to limit reachability to the vulnerable service. Increase monitoring for anomalous HTTPS requests and unexpected identity-data reads or modifications. Interim controls should be validated carefully because access restrictions may affect dependent application workflows.
Patch, then assume compromise.
Apply Oracle's April 2026 Critical Patch Update for Oracle Fusion Middleware addressing CVE-2026-34287 in Oracle Identity Manager Connector Core 12.2.1.4.0. Organizations should deploy the vendor-supplied fix through normal patch management processes and prioritize externally reachable or broadly accessible deployments. Because this vulnerability appears alongside multiple related flaws in the same component, applying the full relevant CPU patch set is preferable to selective remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.