CVE-2026-91501: Medium severity Oracle Oracle Identity Manager vulnerability
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager executes to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments running Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 are affected. Exploitation requires a low-privileged attacker to have logon access to the infrastructure where Oracle Identity Manager executes, so it is not described as remotely exploitable without that access.
What access does an attacker need, and what could they obtain?
An attacker needs local access and low privileges on the infrastructure hosting Oracle Identity Manager; no user interaction is required. Successful exploitation can provide unauthorized access to critical data or complete access to data accessible by Oracle Identity Manager.