CVE-2026-34283
Unauthorized Data Access via Identity Console in Oracle Identity Manager
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | identity_manager | 12.2.1.4.0 |
| oracle | identity_manager | 14.1.2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically in the Identity Console component. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP.
Successful exploitation requires human interaction from a person other than the attacker. Although the vulnerability is in Oracle Identity Manager, attacks may also impact additional products due to a scope change.
If successfully exploited, the attacker can gain unauthorized update, insert, or delete access to some Oracle Identity Manager accessible data, as well as unauthorized read access to a subset of that data.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access and modification of data within Oracle Identity Manager. An attacker could update, insert, or delete data without authorization, and also read sensitive data they should not have access to.
Because the vulnerability requires human interaction and network access, it could be exploited in environments where users interact with Oracle Identity Manager via HTTP.
The impact extends beyond just Oracle Identity Manager, potentially affecting additional products due to the scope change, which could increase the overall risk to your systems.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized read and modification access to some data within Oracle Identity Manager, which could lead to unauthorized disclosure or alteration of sensitive information.
Such unauthorized access and data compromise may negatively impact compliance with data protection regulations and standards like GDPR and HIPAA, which require strict controls over data confidentiality and integrity.
However, the provided information does not explicitly state the direct impact on compliance with these standards.