CVE-2026-91501 Oracle Corporation CVE debrief

Who should care

Oracle Identity Manager administrators and security teams responsible for patching and securing Oracle Fusion Middleware installations should review and apply patches, verify system configurations, and monitor for suspicious activity. These teams should also ensure that system logs are reviewed for any signs of exploitation and that compensating controls are in place for exposed systems.

Why it matters

CVE-2026-91501 is a medium-severity vulnerability in Oracle Identity Manager that allows low-privileged attackers to compromise the system and access critical data. Oracle Identity Manager administrators and security teams should review and apply patches, verify system configurations, and monitor for suspicious activity.

• Potential unauthorized access to critical data
• Need for verification of system configurations and access controls
• Potential for lateral movement and further exploitation

Technical summary

The vulnerability is in the Installer component of Oracle Identity Manager, affecting versions 12.2.1.4.0 and 14.1.2.1.0. It allows low-privileged attackers with logon access to compromise the system, potentially leading to unauthorized access to critical data. The vulnerability has a CVSS score of 5.5 and is considered medium-severity. Administrators should review and apply patches, verify system configurations, and monitor for suspicious activity to mitigate potential risks. The vulnerability could allow attackers to access sensitive data without requiring high privileges.

Defensive priority

Medium-priority patching and verification recommended for Oracle Identity Manager installations.

Recommended defensive actions

• Review and apply Oracle's security patches for Oracle Identity Manager
• Verify system configurations and access controls
• Monitor system logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.5 and affected versions. However, additional information on remediation and specific configurations is limited. Defenders should verify system configurations, review official advisories, and monitor for suspicious activity. The vulnerability is in the Installer component, which may impact system security if not properly patched.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.