CVE-2026-91494 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Identity Manager Connector instances, security teams, and IT administrators should assess exposure and potential impact. This includes operators of affected systems, platform administrators, vulnerability management teams, and security teams responsible for reviewing and applying patches. The vulnerability's high severity and potential impact on critical data and system accessibility make it a priority for these groups to

Why it matters

CVE-2026-91494 is a high-severity vulnerability in Oracle Identity Manager Connector that requires verification of exposure and assessment of potential impact on critical data and system accessibility.

• Potential unauthorized creation, deletion, or modification of critical data
• Possible unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data
• Need for verification of exposure and impact on Oracle Identity Manager Connector instances
• Priority for applying Oracle's security patches and recommendations

Technical summary

The Oracle Identity Manager Connector product has a high-severity vulnerability (CVSS 7.4) that allows unauthenticated attackers with network access to compromise the system, potentially leading to unauthorized data access and modification. The vulnerability affects Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. Defenders should prioritize verifying exposure and assessing potential impact on Oracle Identity Manager Connector instances. The vulnerability has a CVSS vector of (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on Oracle Identity Manager Connector instances.

Recommended defensive actions

• Verify Oracle Identity Manager Connector instances for potential exposure
• Assess the impact of the vulnerability on critical data and system accessibility
• Review and apply Oracle's security patches and recommendations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information from Oracle may be necessary for comprehensive risk assessment. The vulnerability is difficult to exploit and allows unauthenticated attackers with network access via TCP to compromise Oracle Identity Manager Connector. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.