An easily exploitable flaw in the End User Self Service component of Oracle Identity Manager lets an attacker take over the product completely. The attacker needs no login, only a network connection to the product over T3 or IIOP. The flaw has a CVSS 3.1 score of 9.8.
What Is It
CVE-2026-91408 is a vulnerability in Oracle Identity Manager, part of Oracle Fusion Middleware. The affected component is End User Self Service. Oracle's description calls it "easily exploitable." An attacker doesn't need an account or password. They only need to reach the server over the T3 or IIOP protocols to compromise Oracle Identity Manager.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms:
- Attack Vector: Network. The attack can be launched remotely over the network.
- Attack Complexity: Low. No special conditions or timing are needed.
- Privileges Required: None. The attacker doesn't need an account.
- User Interaction: None. Nobody has to click a link or open a file.
- Scope: Unchanged. The direct damage stays within Oracle Identity Manager itself.
- Confidentiality / Integrity / Availability: High / High / High. The attacker can read data, change data, and shut down the service.
NVD lists the record as "Received" and published it on 2026-10-20. Oracle ([email protected]) is the source.
Why It Matters
Oracle says a successful attack can result in takeover of Oracle Identity Manager. Identity Manager controls who gets accounts and what access they have across an organization. An attacker who takes it over could read the identity data it stores, change accounts and access rights, and knock the service offline. The flaw needs no credentials and no user interaction, and it's easy to pull off. That's why CVSS gives it the highest possible ease-of-exploitation score (3.9 out of 3.9) and an impact score of 5.9.
Exploitation status: the CISA KEV entry supplied for this CVE is empty. KEV does not confirm that anyone is actively exploiting it at this time.
What's Vulnerable
Oracle lists these supported versions of Oracle Identity Manager as affected:
- 12.2.1.4.0
- 14.1.2.1.0
Any installation running one of these versions is exposed if an attacker can reach it over T3 or IIOP. The NVD record does not list any affected CPEs yet.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update advisory. Administrators should check that advisory for fix details and apply the update to affected Oracle Identity Manager versions. Because no KEV entry exists for this CVE, the supplied data includes no CISA required action or due date.