CVE-2026-91488 in Identity Manager Connector
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Generic REST connector component of Oracle Identity Manager, a critical element of the Oracle Fusion Middleware suite used for managing digital identities and access across enterprise environments. This specific flaw affects versions 12.2.1.4.0 and 14.1.2.1.0, representing significant portions of deployed infrastructure where automated identity provisioning and de-provisioning rely on RESTful API interactions to synchronize user data with external systems. The core technical issue stems from insufficient validation or authorization checks within the connector's handling of incoming requests, allowing an attacker who has already gained low-privileged access to the underlying operating system or network segment hosting the Oracle Identity Manager Connector service to exploit this weakness. Because the vulnerability does not require any user interaction and can be triggered remotely if the service is exposed locally via loopback interfaces or internal networks, it presents a serious risk for lateral movement within compromised environments where identity management services are often granted elevated privileges to perform their functions effectively.
From an operational perspective, successful exploitation of this flaw enables unauthorized creation, deletion, or modification of critical data managed by Oracle Identity Manager. This includes the ability to alter user attributes, modify group memberships, or manipulate access policies that govern who can access which resources within the organization's IT ecosystem. The impact extends beyond simple data corruption; it allows for complete compromise of the integrity and confidentiality of identity-related information. An attacker could create backdoor accounts with administrative privileges, delete audit trails associated with security events, or exfiltrate sensitive personal identifiable information stored in user profiles. This level of access effectively undermines the foundational trust model of the organization's Identity and Access Management strategy, potentially leading to broader system compromise as these identities are often used to authenticate into other critical business applications and databases.
The severity of this vulnerability is quantified by a CVSS 3.1 Base Score of 7.1, indicating a High risk level primarily driven by high impacts on both confidentiality and integrity while availability remains unaffected in the base score calculation. The vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) highlights that although the attack requires local or adjacent network access, it demands low complexity and only low privileges to initiate, yet yields high consequences for data exposure and modification. This aligns with common exploitation patterns where attackers leverage compromised endpoints or services with minimal permissions to pivot toward more privileged systems. In terms of industry standard classifications, this vulnerability is consistent with CWE-287 Improper Authentication and CWE-918 Server-Side Request Forgery (SSRF) variants if the connector improperly processes external inputs that influence internal resource access. Furthermore, from a threat intelligence perspective such as MITRE ATT&CK, this behavior maps to techniques involving Account Manipulation for persistence or Data Staged for exfiltration, reflecting the attacker's ability to alter identity states and potentially harvest sensitive data through the compromised connector interface.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary action is to apply the latest security patches provided by Oracle for the affected versions of Oracle Identity Manager Connector as soon as they are available, ensuring that all instances running version 12.2.1.4.0 or 14.1.2.1.0 are updated to a secure baseline. In environments where patching is not immediately feasible, organizations should implement strict network segmentation policies to restrict access to the Oracle Identity Manager Connector services from untrusted networks and limit connectivity only to authorized management stations using strong mutual TLS authentication. Additionally, enforcing principle of least privilege on the operating system level ensures that even if an attacker gains low-level access, they cannot easily escalate privileges or interact with sensitive identity stores without additional exploitation steps. Regular auditing of connector logs for anomalous creation or modification events can also aid in early detection and response to potential exploitation attempts before significant damage occurs.