CVE-2026-34285

CVE-2026-34285 is a critical vulnerability affecting Oracle Identity Manager Connector version 12.2.1.4.0 within the Oracle Fusion Middleware product suite. The flaw resides in the Core component and allows unauthenticated attackers to compromise the system through network-accessible HTTPS interfaces. Successful exploitation enables unauthorized creation, deletion, and modification of critical data, as well as complete unauthorized access to all system-accessible information. The vulnerability presents a high-severity attack profile with a CVSS 3.1 base score of 9.1 (Critical). It requires only network access via HTTPS with no authentication, low attack complexity, and no user interaction, making it easily exploitable. The impact is significant, with confirmed high-severity effects on both confidentiality and integrity of data, though availability is not directly impacted. Currently, CVE-2026-34285 shows limited active exploitation with an EPSS score of 0.0003, indicating relatively low real-world exploitation probability at this time. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and carries a FAUCET Risk Score of 52.0/100. However, the critical CVSS rating and ease of exploitation warrant immediate patching of affected systems given the potential for future exploitation and significant data compromise risk.