CVE-2026-34283
Received Received - Intake
Unauthorized Data Access via Identity Console in Oracle Identity Manager

Publication date: 2026-04-21

Last updated on: 2026-04-23

Assigner: Oracle

Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as unauthorized read access to a subset of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-21
Last Modified
2026-04-23
Generated
2026-06-16
AI Q&A
2026-04-22
EPSS Evaluated
2026-06-14
NVD
CVE-2026-34283
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
oracle identity_manager 12.2.1.4.0
oracle identity_manager 14.1.2.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically in the Identity Console component. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP.

Successful exploitation requires human interaction from a person other than the attacker. Although the vulnerability is in Oracle Identity Manager, attacks may also impact additional products due to a scope change.

If successfully exploited, the attacker can gain unauthorized update, insert, or delete access to some Oracle Identity Manager accessible data, as well as unauthorized read access to a subset of that data.

Compliance Impact

The vulnerability allows unauthorized read and modification access to some data within Oracle Identity Manager, which could lead to unauthorized disclosure or alteration of sensitive information.

Such unauthorized access and data compromise may negatively impact compliance with data protection regulations and standards like GDPR and HIPAA, which require strict controls over data confidentiality and integrity.

However, the provided information does not explicitly state the direct impact on compliance with these standards.

Impact Analysis

This vulnerability can lead to unauthorized access and modification of data within Oracle Identity Manager. An attacker could update, insert, or delete data without authorization, and also read sensitive data they should not have access to.

Because the vulnerability requires human interaction and network access, it could be exploited in environments where users interact with Oracle Identity Manager via HTTP.

The impact extends beyond just Oracle Identity Manager, potentially affecting additional products due to the scope change, which could increase the overall risk to your systems.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart