Threats affecting pkg:maven/com.oracle/identity-manager-connector

CVE-2026-34294 is a medium severity vulnerability in Oracle Identity Manager Connector version 12.2.1.4.0. It allows a low privileged attacker with network access via LDAP to potentially compromise the connector, leading to unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to some data. The vulnerability is difficult to exploit and has a CVSS 3.1 base score of 5.9. Oracle has included patches for this and other vulnerabilities in its April 2026 Critical Patch Update.

CVE-2026-34290 is a high-severity vulnerability in Oracle Identity Manager Connector version 12.2.1.4.0. It allows an unauthenticated attacker with network access via TCP to cause a denial of service by hanging or repeatedly crashing the service. The vulnerability impacts availability but does not affect confidentiality or integrity. Oracle has included patches for this and other vulnerabilities in their April 2026 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.

CVE-2026-34289 is a vulnerability in Oracle Identity Manager Connector version 12.2.1.4.0 that allows an unauthenticated attacker with network access via HTTPS to potentially gain unauthorized access to critical or all accessible data within the connector. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.9, indicating a confidentiality impact without integrity or availability effects. The vulnerability is considered difficult to exploit. Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory, recommending customers apply the update promptly.

CVE-2026-34288 is a vulnerability in Oracle Identity Manager Connector version 12.2.1.4.0 that allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical or all accessible data within the product. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.9, primarily impacting confidentiality. Exploitation is considered difficult due to high attack complexity. No known exploits are reported in the wild.

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

CVE-2026-34286 is a critical vulnerability in Oracle Identity Manager Connector version 12.2.1.4.0. It allows an unauthenticated attacker with network access via HTTPS to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and integrity impact. Oracle has included patches for this vulnerability in their April 2026 Critical Patch Update.

CVE-2026-34285 is a critical vulnerability in Oracle Identity Manager Connector version 12.2.1.4.0. It allows an unauthenticated attacker with network access via HTTPS to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and integrity impacts. Oracle has included patches for this and other vulnerabilities in its April 2026 Critical Patch Update.