Introduction
Oracle's April 2026 Critical Patch Update fixed a cluster of critical vulnerabilities in the Oracle Identity Manager Connector. CVE-2026-34286 stands out with a CVSS 3.1 score of 9.1, because it needs no authentication and can be exploited over the network. In organizations running Oracle Fusion Middleware with identity management connectors, a remote attacker can use it to read and manipulate all identity data the connector can access, without ever presenting credentials.
Oracle Identity Manager Connector is a component within Oracle Fusion Middleware that connects Oracle Identity Manager to external target systems (directories, databases, applications) for automated identity provisioning and lifecycle management. It is widely deployed in enterprise environments that rely on Oracle's identity governance stack, particularly in financial services, government, and large enterprises managing thousands of user identities. A flaw in this component bears directly on the integrity of identity provisioning workflows and the confidentiality of identity data moving between systems.
Technical Information
The vulnerability is in the Core component of the Oracle Identity Manager Connector within the Oracle Fusion Middleware suite. Oracle describes it as easily exploitable by an unauthenticated attacker with network access to the system via HTTPS. An attacker can target any exposed endpoint that handles HTTPS traffic for the connector directly, with no prior credential compromise or internal system access.
CVSS 3.1 Vector Analysis
The full CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which breaks down as follows:
| Metric | Value | Implication |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over HTTPS without local access |
| Attack Complexity | Low | No special conditions or race conditions needed |
| Privileges Required | None | No prior authentication or user credentials needed |
| User Interaction | None | Executes without any action from a legitimate user |
| Scope | Unchanged | Impact confined to the vulnerable component |
| Confidentiality Impact | High | Complete unauthorized access to critical data |
| Integrity Impact | High | Unauthorized creation, deletion, or modification of data |
| Availability Impact | None | System stays operational, so attacks are stealthy |
Attack Characteristics
With High Confidentiality and High Integrity impact but no Availability impact, this flaw is hard to detect. An attacker can silently exfiltrate or alter identity data without causing the downtime or service degradation that usually sets off alerts. In an identity management system, that means user accounts could be created, privileges escalated, or identity records modified without obvious operational disruption.
Oracle has not published technical details of the root cause beyond the advisory metadata. The attack characteristics (unauthenticated, network accessible via HTTPS, targeting the Core component) indicate a flaw in the connector's basic processing or authorization of incoming HTTPS requests. Sibling CVEs CVE-2026-34285 and CVE-2026-34287 share the same CVSS score, the same affected version, and the same attack profile, which suggests a systemic issue in the Core component's request handling or authorization logic rather than an isolated bug.
Broader Vulnerability Cluster
CVE-2026-34286 is one of at least seven CVEs patched in the Oracle Identity Manager Connector's Core component in the April 2026 CPU:
| CVE | CVSS Score | Protocol | Notes |
|---|---|---|---|
| CVE-2026-34285 | 9.1 | HTTPS | Identical attack profile to CVE-2026-34286 |
| CVE-2026-34286 | 9.1 | HTTPS | This vulnerability |
| CVE-2026-34287 | 9.1 | HTTPS | Identical attack profile to CVE-2026-34286 |
| CVE-2026-34288 | 5.9 | HTTPS | Higher attack complexity required |
| CVE-2026-34289 | 5.9 | HTTPS | Higher attack complexity required |
| CVE-2026-34290 | 7.5 | TCP | Denial of service vector |
| CVE-2026-34294 | 5.9 | LDAP | Requires low privileges |
The clustering strongly suggests that Oracle audited the Identity Manager Connector's core more broadly and fixed several related issues it found there.
Patch Information
Oracle fixed CVE-2026-34286 in its April 2026 Critical Patch Update (CPU), released on April 21, 2026. This quarterly CPU contains 483 new security patches across a wide range of Oracle products.
The only affected version is 12.2.1.4.0 of the Oracle Identity Manager Connector. As usual with Oracle CPUs, the patch binaries are not publicly available. Oracle distributes them through My Oracle Support (MOS) and does not publish open-source diffs or technical descriptions of the fix beyond the advisory metadata.
Customers with active Oracle support contracts should apply the April 2026 CPU patch set for Oracle Fusion Middleware 12.2.1.4.0 to remediate this vulnerability. Because the same component has several related CVEs, we strongly recommend applying the full CPU rather than individual patches.
Prioritization guidance:
- Patch instances reachable from the public internet over HTTPS immediately.
- Patch internally accessible instances as soon as possible after that.
- While patches are being deployed, monitor audit logs more closely for unusual identity lifecycle events such as unexpected account creations, privilege escalations, or bulk data modifications.
- Security operations centers should watch for anomalous HTTPS traffic directed at Oracle Identity Manager Connector endpoints.
Affected Systems and Versions
The vulnerability affects a single version:
- Product: Oracle Identity Manager Connector
- Component: Core
- Product Family: Oracle Fusion Middleware
- Affected Version: 12.2.1.4.0
- Protocol: HTTPS
Other Oracle Fusion Middleware products patched in the same April 2026 CPU, and worth reviewing if they are deployed alongside the connector:
- Oracle Identity Manager: versions 12.2.1.4.0, 14.1.2.0.0, 14.1.2.1.0
- Oracle Access Manager: version 14.1.2.0.0
- Oracle WebLogic Server: versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Vendor Security History
The April 2026 CPU contains 483 new security patches across Oracle's product portfolio, in line with the usual size of Oracle's quarterly patch cycles. Seven related CVEs in the Oracle Identity Manager Connector's Core component alone, in a single CPU, suggest a focused security review of the connector's codebase. Oracle's advisory language ("Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible") is the vendor's standard urgency guidance for critical-severity issues.
