CVE-2026-34294
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Vulnerability in Oracle Identity Manager Connector (component: Microsoft Active Directory) affecting version 12.2.1.4.0. A difficult to exploit vulnerability allows a low privileged attacker with network access via LDAP to compromise the product, resulting in unauthorized creation, deletion or modification of critical data and unauthorized read access to a subset of data.
Risk Assessment
A low privileged attacker could modify or delete critical data and gain unauthorized read access to some data, impacting integrity and confidentiality.
Recommendation
Apply the Oracle Critical Patch Update fixes for Oracle Identity Manager Connector 12.2.1.4.0.
Other vulnerabilities in Oracle Identity Manager Connector
See all- CVE-2017-10270High
A vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory) allows easy exploitation by an unauthenticated attacker with access to the infrastructure where Oracle Identity Manager Connector operates. Attacks can lead to unauthorized access to critical data and may cause system crashes.
- CVE-2026-91491Critical
Vulnerability in Oracle Identity Manager Connector (LDAP Gateway component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via LDAP can take over Oracle Identity Manager Connector. CVSS 9.8.
- CVE-2026-91490Critical
Vulnerability in Oracle Identity Manager Connector (LDAP Gateway component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via LDAP can create, delete, or modify critical data and gain unauthorized access to it. CVSS 9.1.
- CVE-2026-83027Critical
Vulnerability in Oracle Identity Manager Connector (Core component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with access to the physical communication segment attached to the hardware running Oracle Identity Manager Connector can gain unauthorized access to data, including creation, deletion, and modification.
- CVE-2026-60995Critical
Vulnerability in Oracle Identity Manager Connector (component: Core) affects versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable flaw allows low privileged attacker with network access via TLS to compromise Oracle Identity Manager Connector. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-60990Critical
Vulnerability in Oracle Identity Manager Connector (component: Core) affects versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable flaw allows low privileged attacker with network access via TLS to compromise Oracle Identity Manager Connector. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-60535Critical
Vulnerability in Oracle Identity Manager Connector (PeopleSoft Applications component) allows an unauthenticated attacker to remotely take over the system via HTTP. It requires only network access and no privileges or user interaction.
- CVE-2026-60532Critical
Vulnerability in Oracle Identity Manager Connector (PeopleSoft Applications component) allows an unauthenticated attacker to remotely take over the system via HTTP. It requires only network access and no privileges or user interaction.
- CVE-2026-60531Critical
Vulnerability in Oracle Identity Manager Connector (component: Core). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can compromise the connector, potentially impacting other products.
- CVE-2026-91494High
Vulnerability in the LDAP Gateway component of Oracle Identity Manager Connector (Oracle Fusion Middleware). An unauthenticated attacker can exploit it over the network via TCP to gain unauthorized creation, deletion or modification access to critical data and full access to connector data; exploitation is difficult. CVSS 7.4.
Original NVD description (English source)
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized read access to a subset of Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS