CVE-2026-91408
Analyzed Analyzed - Analysis Complete

Oracle Identity Manager Authentication Bypass

Publication date: 2026-10-20

Last updated on: 2026-11-03

Assigner: Oracle

Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-11-03
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-91408
EUVD
EUVD-2026-106660

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
oracle identity_manager 12.2.1.4.0
oracle identity_manager 14.1.2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical vulnerability in Oracle Identity Manager, a middleware product. It allows unauthenticated attackers to remotely access and compromise the system via network protocols T3 and IIOP. Successful exploitation could lead to full takeover of the Oracle Identity Manager instance.

Detection Guidance

This vulnerability affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 via T3 or IIOP protocols. Detection requires checking for exposed Oracle Identity Manager instances on these versions. Use network scanning tools like Nmap to identify Oracle services running on default ports (e.g., 7001 for WebLogic). Verify if the Oracle Identity Manager component is installed and accessible via T3/IIOP.

Impact Analysis

An attacker could gain complete control over your Oracle Identity Manager system, potentially accessing sensitive user data, modifying configurations, or disrupting services. This could lead to data breaches, unauthorized access to applications, or system downtime.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, violating GDPR and HIPAA requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Immediately apply the latest Oracle Critical Patch Update for Oracle Identity Manager. Restrict network access to T3 and IIOP ports using firewalls. Disable or block external access to these ports if not required. Monitor for suspicious activity and ensure all Oracle Identity Manager instances are updated to patched versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...