CVE-2026-34294
LDAP Privilege Escalation in Oracle Identity Manager Connector
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | identity_manager_connector | 12.2.1.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a low privileged attacker with network access via LDAP to perform unauthorized creation, deletion, modification, and read access to critical or accessible data within the Oracle Identity Manager Connector. Such unauthorized access and data manipulation could potentially lead to violations of data protection and privacy regulations like GDPR and HIPAA, which require strict controls over data confidentiality and integrity.
However, the provided information does not explicitly mention the impact on compliance with specific standards or regulations.
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Identity Manager Connector product, specifically in the Microsoft Active Directory component of Oracle Fusion Middleware version 12.2.1.4.0. It is difficult to exploit but allows a low privileged attacker with network access via LDAP to compromise the Oracle Identity Manager Connector.
If successfully exploited, the attacker can gain unauthorized capabilities such as creating, deleting, or modifying critical data or any data accessible through the Oracle Identity Manager Connector. Additionally, the attacker can read some subset of the accessible data without authorization.
How can this vulnerability impact me? :
The impact of this vulnerability includes unauthorized modification, creation, or deletion of critical data within the Oracle Identity Manager Connector environment. This can lead to data integrity issues and potential disruption of services relying on this data.
There is also unauthorized read access to some data, which can result in confidentiality breaches. Overall, this can compromise the security and trustworthiness of the system.