Oracle Identity Manager: Authentication bypass in REST WebServices
Summary
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a vulnerability in the REST WebServices component that is classified as missing authentication (CWE-306). An attacker with a low-privileged account and network access via HTTP can compromise the product, with a CVSS 3.1 base score of 8.8. Oracle has addressed this in its October 2026 Critical Patch Update, but no exploitation has been reported.
Affected
- Oracle Identity Manager 12.2.1.4.0
- Oracle Identity Manager 14.1.2.1.0
Fixed in
- Oracle's October 2026 Critical Patch Update (CPU) is the stated remediation path. Confirm the patch mapping on the Oracle advisory.
- Fixed build numbers: Unknown.
Workaround
- No vendor-confirmed workaround found.
- Until patched, restrict access to the REST API to internal networks or VPN and block it from the internet at the reverse proxy or firewall.
- Review and reduce permissions of accounts that can call the REST API.
Exploitation
- No evidence of active exploitation found.
- CISA SSVC: Exploitation none, automatable no.
- Not listed in CISA KEV.
- No public proof-of-concept found in limited searches.
Our recommendation
- Check whether Oracle Identity Manager is installed and which versions are in use.
- If it is installed and reachable beyond the internal network, apply the October 2026 CPU as a priority.
- Restrict REST API exposure and review accounts with API access until patched.
- Monitor logs for unusual REST API requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- Oracle Security Blog: October 2026 Critical Patch Update released blogs.oracle.com
- VulDB CVE-2026-91407 vuldb.com
- OpenCVE CVE-2026-91407 app.opencve.io
- Strix CVE-2026-91407 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:27.
Original description (NVD)
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.