CVE-2026-91488: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-91488 Overview

CVE-2026-91488 is a high-severity vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware. The flaw resides in the Generic REST component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with logon access to the infrastructure where Oracle Identity Manager Connector executes can compromise the product. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, along with unauthorized access to all data accessible to the connector.

Critical Impact
Local attackers with low privileges can read, create, delete, or modify all data accessible to the Oracle Identity Manager Connector, breaking confidentiality and integrity of identity management operations.

Affected Products

Oracle Identity Manager Connector 12.2.1.4.0
Oracle Identity Manager Connector 14.1.2.1.0
Oracle Fusion Middleware - Generic REST component

Discovery Timeline

2026-10-20 - CVE-2026-91488 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database
October 2026 - Addressed in the Oracle Critical Patch Update

Technical Details for CVE-2026-91488

Vulnerability Analysis

The vulnerability affects the Generic REST component of the Oracle Identity Manager Connector. The connector brokers identity data between Oracle Identity Manager and downstream applications exposed over REST interfaces. A flaw in how the component handles authenticated local requests allows a low-privileged account to bypass intended access controls on connector data. The attack requires local logon access to the host executing the connector, so network-only attackers cannot reach the flaw directly.

Root Cause

Oracle has not published the root-cause CWE classification for this issue. Based on the vendor description, the defect sits in authorization enforcement for Generic REST operations exposed by the connector. The component permits a low-privileged local user to invoke operations that should be restricted to higher-privileged identity administrators. No CWE identifier is listed in the NVD record.

Attack Vector

Exploitation requires local logon to the infrastructure where the Oracle Identity Manager Connector runs. The attack complexity is low and no user interaction is required. Once authenticated locally with any valid low-privileged account, the attacker interacts with the Generic REST component to read, create, modify, or delete connector-accessible data. Availability is not impacted. Refer to the Oracle Critical Patch Update October 2026 for vendor technical details.

No verified proof-of-concept code has been published for this vulnerability. Oracle has not disclosed exploitation internals in the Critical Patch Update advisory.

Detection Methods for CVE-2026-91488

Indicators of Compromise

Unexpected REST API calls to the Oracle Identity Manager Connector from low-privileged local accounts
Unauthorized create, update, or delete operations against identity records managed by the Generic REST connector
Anomalous access patterns to connector configuration files or runtime processes from non-administrative users

Detection Strategies

Review Oracle Identity Manager audit logs for Generic REST operations performed by accounts outside the identity administration group
Correlate local logon events on the connector host with subsequent REST invocations to identify low-privileged abuse
Baseline normal connector activity and alert on deviations in operation types, call frequency, or data volumes

Monitoring Recommendations

Enable verbose auditing on the Generic REST component and forward logs to a centralized SIEM for retention and analysis
Monitor file-system and process access on hosts running the Oracle Identity Manager Connector
Track changes to identity data stores for creation, modification, or deletion events that lack a corresponding administrative workflow

How to Mitigate CVE-2026-91488

Immediate Actions Required

Apply the Oracle Critical Patch Update October 2026 to all affected Oracle Identity Manager Connector deployments
Inventory hosts running Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 and prioritize patching
Audit local account access on connector hosts and remove unnecessary logon rights

Patch Information

Oracle addressed CVE-2026-91488 in the October 2026 Critical Patch Update. Administrators should download and install the patch bundle for Oracle Fusion Middleware from the Oracle Critical Patch Update October 2026 advisory. Oracle recommends applying Critical Patch Updates without delay because supported patches are only produced for currently supported product versions.

Workarounds

Restrict local logon on connector hosts to a minimal set of trusted administrative accounts
Enforce least-privilege operating-system permissions on connector binaries, configuration, and runtime directories
Isolate Oracle Identity Manager Connector infrastructure on dedicated hosts with strict network and identity segmentation

bash

# Review local logon rights on a Linux connector host
getent group | grep -Ei 'oracle|oim|identity'
last -n 50 | awk '{print $1}' | sort -u

# List processes and listening endpoints associated with the connector
ps -ef | grep -i connector
ss -tlnp | grep -i java