Oracle Identity Manager Flaw Allows Unauthenticated Remote Takeover

A critical security vulnerability has been identified in Oracle Identity Manager, a component of Oracle Fusion Middleware. The flaw, tracked as CVE-2026-91408, allows unauthenticated attackers with network access to fully compromise the system. This discovery highlights significant risks for organizations relying on this identity management solution.

The National Vulnerability Database rates the issue with a CVSS 3.1 base score of 9.8. This score reflects high impacts on confidentiality, integrity, and availability. The vulnerability is located within the End User Self Service component. Attackers do not need valid credentials to exploit this weakness, making it easily exploitable from a distance.

Technical Details and Attack Vector

The vulnerability can be exploited through the T3 or IIOP network protocols. These protocols are commonly used for communication between Oracle components and clients. An attacker with network access can send malicious requests via these channels. Successful exploitation results in a complete takeover of the Oracle Identity Manager instance.

The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates network accessibility, low complexity, and no user interaction required. The scope is unchanged, but the impact is high across all security pillars. This combination makes the flaw particularly dangerous for exposed systems.

Affected Versions and Scope

Only specific versions of Oracle Identity Manager are affected by this vulnerability. According to the NVD record, version 12.2.1.4.0 is vulnerable. Version 14.1.2.1.0 is also listed as affected. Organizations running these specific releases must verify their exposure immediately. Other versions of the product are not mentioned in the advisory.

The flaw resides in the End User Self Service component. This part of the software handles user interactions and service requests. Because it is accessible via network protocols, it presents a direct attack surface. The lack of authentication requirements for exploitation amplifies the risk significantly.

What should you do?

Organizations should immediately audit their environments to identify if they are running the affected versions. Network administrators should review firewall rules to restrict T3 and IIOP traffic. Monitoring logs for unusual activity on these ports can help detect attempts. Users should prepare for potential updates once the vendor releases them.

What to do and how to stay safe: Oracle

• Inventory all Oracle Identity Manager instances to check for versions 12.2.1.4.0 and 14.1.2.1.0.
• Restrict network access to T3 and IIOP ports to trusted internal networks only.
• Monitor network traffic for unauthorized connections attempting to use these protocols.
• Prepare to apply patches once Oracle releases an official update for this vulnerability.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91408?

The CVSS 3.1 base score is 9.8, which is rated as critical severity.

Which versions of Oracle Identity Manager are affected?

Versions 12.2.1.4.0 and 14.1.2.1.0 are affected by this vulnerability.

Can an attacker exploit this flaw without credentials?

Yes, the vulnerability allows unauthenticated attackers to compromise the system.