CVE-2026-34283

Received Received - Intake

Unauthorized Data Access via Identity Console in Oracle Identity Manager

Publication date: 2026-04-21

Last updated on: 2026-04-23

Assigner: Oracle

Description

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as unauthorized read access to a subset of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-21

Last Modified

2026-04-23

Generated

2026-07-06

AI Q&A

2026-04-22

EPSS Evaluated

2026-07-05

NVD

CVE-2026-34283

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	identity_manager	12.2.1.4.0
oracle	identity_manager	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Compliance Impact

The vulnerability allows unauthorized read and modification access to some data within Oracle Identity Manager, which could lead to unauthorized disclosure or alteration of sensitive information.

Such unauthorized access and data compromise may negatively impact compliance with data protection regulations and standards like GDPR and HIPAA, which require strict controls over data confidentiality and integrity.

However, the provided information does not explicitly state the direct impact on compliance with these standards.

Executive Summary

This vulnerability exists in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically in the Identity Console component. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP.

Successful exploitation requires human interaction from a person other than the attacker. Although the vulnerability is in Oracle Identity Manager, attacks may also impact additional products due to a scope change.

If successfully exploited, the attacker can gain unauthorized update, insert, or delete access to some Oracle Identity Manager accessible data, as well as unauthorized read access to a subset of that data.

Impact Analysis

This vulnerability can lead to unauthorized access and modification of data within Oracle Identity Manager. An attacker could update, insert, or delete data without authorization, and also read sensitive data they should not have access to.

Because the vulnerability requires human interaction and network access, it could be exploited in environments where users interact with Oracle Identity Manager via HTTP.

The impact extends beyond just Oracle Identity Manager, potentially affecting additional products due to the scope change, which could increase the overall risk to your systems.

Hi! I’m here to help you understand CVE-2026-34283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70