CVE-2026-91407 in Identity Manager
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the REST WebServices component of Oracle Identity Manager, a critical identity governance solution included in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. This flaw represents a significant security risk due to its potential for remote exploitation by attackers with relatively low privilege levels. The vulnerability is accessible over standard HTTP protocols, which implies that the attack vector does not require complex network positioning or specialized tools beyond basic connectivity to the affected service endpoints. The presence of this weakness in an identity management system is particularly concerning because such systems serve as the central authority for authenticating and authorizing users across enterprise environments. Compromise of these services can lead directly to unauthorized access, data exfiltration, or disruption of critical business processes that rely on accurate identity state management.
From a technical perspective, the vulnerability allows an attacker with network access and low privileges to execute actions that result in complete takeover of the Oracle Identity Manager application. This level of impact suggests that the flaw likely involves improper validation of input data, insufficient authentication checks within specific REST API endpoints, or logic flaws that allow privilege escalation through standard web service interactions. The ability for a low-privileged user to achieve full administrative control indicates a failure in enforcing proper access controls at the application layer. Such vulnerabilities often stem from complex integration points where different security contexts intersect, leading to situations where lower-level permissions are incorrectly interpreted as higher-level privileges or where sensitive operations lack adequate authorization checks before execution.
The operational impact of this vulnerability is severe, characterized by high scores across confidentiality, integrity, and availability metrics in the CVSS 3.1 scoring system. With a base score of 8.8, classified as High severity, the potential consequences include full disclosure of sensitive identity data, modification of user roles and permissions, and denial of service to legitimate users attempting to access their accounts or applications managed by Oracle Identity Manager. Attackers could exploit this flaw to create backdoor accounts, modify existing credentials, or delete critical configuration settings, effectively neutralizing the security posture of the entire organization's identity infrastructure. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that no user interaction is required and that the attack complexity is low, making it a prime target for automated exploitation tools commonly found in cybercrime arsenals.
In terms of industry standard classifications, this vulnerability aligns with CWE-287 Improper Authentication or CWE-269 Improper Privilege Management, depending on whether the root cause lies in bypassing authentication mechanisms or escalating privileges after initial access. From a tactical standpoint, it maps to MITRE ATT&CK techniques such as T1078 Valid Accounts and potentially T1053 Scheduled Task/Job if persistence is established through modified system configurations. The exploitation of REST WebServices also relates to common web application attack patterns described in CWE-200 Information Exposure or CWE-94 Improper Control of Generation of Code, particularly if the vulnerability involves injection-based mechanisms within API parameters. Understanding these mappings helps security teams prioritize remediation efforts based on established threat models and compliance requirements.
Mitigation strategies must focus on immediate patching and network-level controls until updates are applied. Oracle has likely released a Security Patch Update (SPU) or Critical Patch Update (CPU) addressing this specific issue, which should be installed promptly in all supported environments. In the interim, organizations should restrict access to the affected REST WebServices endpoints using firewalls or reverse proxies, allowing connections only from trusted IP addresses and administrative networks. Implementing strict input validation on any custom integrations that interact with these APIs is also advisable. Additionally, enabling comprehensive logging for authentication failures and privilege escalation attempts can aid in detecting exploitation activities during the remediation window. Regular audits of user permissions within Oracle Identity Manager should be conducted to ensure no unauthorized changes have occurred due to potential prior exploitation.