CVE-2026-91488 Oracle Corporation CVE debrief

Who should care

Defenders and administrators of Oracle Identity Manager Connector systems, particularly those with versions 12.2.1.4.0 and 14.1.2.1.0, should assess exposure and prioritize patching.

Why it matters

CVE-2026-91488 is a high-severity vulnerability in Oracle Identity Manager Connector that allows low-privileged attackers to compromise system data. Defenders should prioritize verifying exposure, applying patches, and monitoring system logs.

• Potential unauthorized data access and modification
• Possible system compromise by low-privileged attackers
• Need for patch verification and application
• Potential for data integrity and confidentiality impacts

Technical summary

The vulnerability in Oracle Identity Manager Connector of Oracle Fusion Middleware (component: Generic REST) allows low-privileged attackers with logon access to compromise Oracle Identity Manager Connector, potentially leading to unauthorized creation, deletion, or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, focusing on systems with Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0.

Recommended defensive actions

• Verify system exposure by checking for Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0
• Apply patches or updates provided by Oracle
• Monitor system logs for suspicious activity
• Restrict access to critical data and systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. However, vendor remediation details and exploit evidence are limited. Defenders should verify exposure by checking system versions, review vendor guidance, and monitor system logs for suspicious activity. The vulnerability allows low-privileged attackers to compromise Oracle Identity Manager Connector, potentially leading to unauthorized data access and modification. There is no evidence of public exploits or widespread attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.