CVE-2026-91211 Oracle CVE debrief

Who should care

Defenders of Oracle Identity Manager Connector deployments, especially those with high privileged access and network connectivity via SOAP, should assess exposure and prioritize remediation.

Why it matters

High privileged attackers with network access via SOAP may compromise Oracle Identity Manager Connector, potentially impacting additional products; defenders should verify exposure and prioritize remediation.

• Potential unauthorized creation, deletion, or modification of critical data
• Possible unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data

Technical summary

Easily exploitable vulnerability in Oracle Identity Manager Connector allows high privileged attackers with network access via SOAP to compromise the system, potentially impacting additional products. Successful attacks can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).

Defensive priority

High privileged attackers with network access via SOAP may compromise Oracle Identity Manager Connector; defenders should verify exposure and prioritize remediation.

Recommended defensive actions

• Verify Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 for exposure
• Restrict network access to SOAP for high privileged attackers
• Monitor for unauthorized creation, deletion, or modification of critical data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Oracle Identity Manager Connector, its impacts, and affected versions. Evidence is limited to public CVE and NVD data. Defenders should verify Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 for exposure and review vendor advisories for specific guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.