CVE-2026-91408 in Identity Manager
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the End User Self Service component of Oracle Identity Manager, a critical module in the Oracle Fusion Middleware suite that facilitates user-centric identity management tasks such as password resets and profile updates. This security flaw affects specific supported versions including 12.2.1.4.0 and 14.1.2.1.0, representing significant risk to organizations relying on these releases for their enterprise access control infrastructure. The core technical issue stems from a design or implementation error that permits unauthenticated actors to interact with the service through legacy network protocols, specifically T3 and IIOP. These protocols are often used in older Java EE environments but can expose internal application logic if not properly secured against external requests lacking valid authentication tokens.
Exploitation of this vulnerability requires no prior authentication, allowing any remote attacker with basic network connectivity to initiate an attack vector directly through the exposed endpoints associated with T3 or IIOP interfaces. The ease of exploitation is classified as low complexity, meaning that automated tools can readily leverage this flaw without requiring sophisticated payload construction or social engineering tactics. Once triggered, the vulnerability enables a complete compromise of the Oracle Identity Manager instance. This level of access allows an attacker to bypass all security controls, effectively taking over the administrative functions and user management capabilities inherent to the platform.
The operational impact of such a takeover is severe, as reflected by the CVSS 3.1 Base Score of 9.8, which indicates critical severity. The high scores across confidentiality, integrity, and availability dimensions suggest that an attacker can exfiltrate sensitive identity data, modify user permissions or group memberships to establish persistent backdoors, and disrupt service availability for legitimate users. In a corporate environment, this could lead to unauthorized access to downstream applications managed by Oracle Identity Manager, lateral movement within the network using compromised credentials, and potential regulatory violations due to exposure of personally identifiable information.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as it allows unauthenticated access to sensitive functionality. It also maps to MITRE ATT&CK techniques related to Initial Access via Network Service Exploitation and potentially Privilege Escalation if the compromised service account holds elevated privileges within the middleware stack. The use of T3 and IIOP protocols highlights a common enterprise security gap where legacy communication channels remain open despite modern security best practices recommending their disablement in favor of more secure alternatives like HTTPS or RMI over TLS.
Mitigation strategies must prioritize immediate remediation through patching to the latest available version that addresses this specific flaw, as Oracle typically releases updates for supported versions within a short timeframe after disclosure. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict access to T3 and IIOP ports exclusively from trusted internal management subnets or disabled entirely if not required by legacy applications. Additionally, implementing strict firewall rules that block external traffic to these specific protocol endpoints can significantly reduce the attack surface. Security teams should also audit existing configurations for other instances of unauthenticated service exposure and ensure that all middleware components are regularly updated according to Oracle Critical Patch Update schedules to maintain a robust security posture against evolving threats.