Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-91492

CVE-2026-91492: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-91492 is an authentication bypass vulnerability in Oracle Identity Manager Connector affecting versions 12.2.1.4.0 and 14.1.2.1.0. Attackers can gain unauthorized access to critical data. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

Published:

CVE-2026-91492 Overview

CVE-2026-91492 affects the Oracle Identity Manager Connector product within Oracle Fusion Middleware, specifically the SAP ERP+ component. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the connector. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data and complete read access to all connector-accessible data. The vulnerability has a scope change, meaning attacks may significantly impact additional products beyond the connector itself. Oracle disclosed the issue as part of its October 2026 Critical Patch Update.

Critical Impact

Unauthenticated network attackers can compromise confidentiality and integrity of Oracle Identity Manager Connector data, with impact extending beyond the vulnerable component due to scope change.

Affected Products

  • Oracle Identity Manager Connector 12.2.1.4.0
  • Oracle Identity Manager Connector 14.1.2.1.0
  • Component: SAP ERP+

Discovery Timeline

  • 2026-10-20 - CVE-2026-91492 published to the National Vulnerability Database
  • 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-91492

Vulnerability Analysis

The vulnerability resides in the SAP ERP+ component of the Oracle Identity Manager Connector. An unauthenticated attacker reaches the vulnerable code path over HTTP without user interaction. Exploitation is rated as high complexity, indicating that specific conditions or timing must be met for a successful attack. The scope change indicates the vulnerable component can affect resources beyond its own security authority, including downstream identity-managed systems. Successful exploitation grants attackers full read and write access to data reachable through the connector, without affecting availability.

Root Cause

Oracle has not published root-cause details beyond the advisory. The scope change combined with unauthenticated network reachability suggests improper access control or input validation within the HTTP interface of the SAP ERP+ connector integration. Because the Identity Manager Connector mediates provisioning between Oracle Identity Manager and SAP ERP systems, a flaw in this component can expose identity data and provisioning operations tied to connected enterprise resource planning systems.

Attack Vector

The attack vector is network-based over HTTP. No authentication or user interaction is required. An attacker needs the ability to send crafted HTTP requests to the connector endpoint. The high attack complexity suggests additional preconditions, such as specific configurations, race conditions, or chained request sequences, must be satisfied. Refer to the Oracle Critical Patch Update - October 2026 for exploitation prerequisites and mitigation guidance.

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-91492

Indicators of Compromise

  • Unexpected provisioning or deprovisioning events in Oracle Identity Manager audit logs tied to the SAP ERP+ connector
  • Unauthenticated HTTP requests to Identity Manager Connector endpoints from untrusted source addresses
  • Unexplained modifications to identity records, role assignments, or SAP account mappings

Detection Strategies

  • Monitor connector-facing HTTP endpoints for anomalous request patterns, including malformed payloads and unusual request volumes
  • Correlate Oracle Identity Manager audit logs with SAP ERP account change events to identify unauthorized provisioning actions
  • Baseline normal connector traffic sources and alert on new or unexpected clients initiating sessions

Monitoring Recommendations

  • Enable verbose audit logging on Oracle Identity Manager and forward logs to a centralized SIEM
  • Alert on account creation, deletion, or modification events outside of approved change windows
  • Track outbound connector activity to SAP ERP for signs of data exfiltration or bulk read operations

How to Mitigate CVE-2026-91492

Immediate Actions Required

  • Apply the October 2026 Oracle Critical Patch Update to all affected Oracle Identity Manager Connector deployments
  • Restrict network access to connector HTTP endpoints to trusted management segments only
  • Review Oracle Identity Manager audit logs for signs of unauthorized provisioning activity prior to patching

Patch Information

Oracle addressed CVE-2026-91492 in the October 2026 Critical Patch Update. Administrators running Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 should apply the fixes documented in the Oracle Critical Patch Update Advisory. No official workaround has been published; patching is the authoritative remediation path.

Workarounds

  • Place the connector behind a reverse proxy or web application firewall that enforces authentication and source IP allowlisting
  • Disable or isolate the SAP ERP+ connector component in environments where it is not required until patches are deployed
  • Enforce network segmentation between Oracle Identity Manager infrastructure and general-purpose user networks

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne