Critical Oracle Identity Manager Flaw: Unauthenticated Data Compromise

The National Vulnerability Database has disclosed CVE-2026-34285, a critical vulnerability in Oracle Identity Manager Connector, specifically affecting version 12.2.1.4.0 of Oracle Fusion Middleware. This flaw is easily exploitable, allowing unauthenticated attackers with network access via HTTPS to compromise the connector.

Successful exploitation grants unauthorized creation, deletion, or modification access to critical data, or even complete access to all data accessible by Oracle Identity Manager Connector. The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.1, citing high impacts on confidentiality and integrity. The attack vector is network-based with low attack complexity and no privileges or user interaction required.

This is a significant risk for organizations relying on Oracle Identity Manager. An unauthenticated network-level vulnerability means external attackers can hit this without prior access or credentials. Defenders must prioritize patching, as this flaw essentially hands over the keys to sensitive identity management data. The attacker’s calculus here is simple: find an exposed instance, exploit, and gain a foothold for broader data exfiltration or manipulation.