CVE-2026-91212 in Identity Manager Connector
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Generic REST connector component of Oracle Identity Manager, a critical module in the Oracle Fusion Middleware suite affecting versions 12.2.1.4.0 and 14.1.2.1.0. This security flaw stems from an insufficient authentication mechanism or improper access control implementation that allows unauthenticated actors to interact with sensitive administrative endpoints exposed via HTTP. The architecture of identity management systems relies heavily on the integrity of connector configurations, which often serve as bridges between Oracle Identity Manager and external target applications such as databases, directories, or enterprise resource planning systems. When a connector is compromised, it does not merely affect the isolated component but can lead to a significant scope change where attacks propagate across additional products within the broader middleware ecosystem due to shared trust relationships and centralized identity data stores.
From a technical perspective, this vulnerability represents a classic case of broken access control where the system fails to verify the identity or privileges of the user before granting access to critical resources. The attacker requires only network access via HTTP and no prior authentication credentials, making it an easily exploitable remote code execution or information disclosure vector. The absence of required authorization checks allows malicious users to query internal APIs that are intended for administrative use only. This flaw aligns with CWE-287 Improper Authentication and CWE-862 Missing Authorization, highlighting a fundamental failure in the security design phase where sensitive operations were not adequately protected by robust identity verification protocols. The reliance on HTTP rather than HTTPS may further exacerbate the risk if transport layer encryption is not enforced elsewhere in the network perimeter, although the primary issue remains the lack of application-level authentication for specific endpoints.
The operational impact of this vulnerability is severe, characterized primarily by high-impact confidentiality breaches as indicated by a CVSS 3.1 Base Score of 8.6. Successful exploitation enables an unauthenticated attacker to gain unauthorized access to critical data managed by Oracle Identity Manager. This includes sensitive user profiles, credential stores, role assignments, and policy configurations that define the security posture of the entire organization. In worst-case scenarios, the attacker achieves complete access to all data accessible through the compromised connector, potentially leading to mass identity theft or privilege escalation within connected systems. The attack vector is classified under ATT&CK technique T1078 Valid Accounts if credentials are stolen via this method, but more accurately reflects T1190 Exploit Public-Facing Application given the unauthenticated nature of the initial access. This can serve as an entry point for lateral movement across the network, allowing adversaries to pivot from identity management systems into core business applications that rely on these identities for authentication and authorization decisions.
Mitigation strategies must focus immediately on restricting external exposure of Oracle Identity Manager administrative interfaces. Organizations should ensure that all communication with Oracle Fusion Middleware components is conducted over HTTPS using strong TLS configurations to prevent eavesdropping and man-in-the-middle attacks, although this does not replace the need for proper application-level authentication. It is imperative to apply the latest security patches provided by Oracle which address these specific access control flaws in versions 12.2.1.4.0 and 14.1.2.1.0. If patching is not immediately feasible, network segmentation should be implemented to restrict HTTP traffic from untrusted networks to the servers hosting Identity Manager connectors. Additionally, implementing Web Application Firewalls with rules that detect and block unauthorized access attempts to administrative REST endpoints can provide a layer of defense in depth. Regular audits of connector configurations and strict adherence to the principle of least privilege for all service accounts associated with these connectors are essential long-term controls to prevent recurrence and limit potential blast radius in future incidents.