Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-91501

CVE-2026-91501: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-91501 is an authentication bypass vulnerability in Oracle Identity Manager that allows low-privileged attackers to access critical data. This post covers technical details, affected versions, and steps to mitigate the risk.

Published:

CVE-2026-91501 Overview

CVE-2026-91501 is a local privilege-context vulnerability in the Installer component of Oracle Identity Manager, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with logon access to the infrastructure where Oracle Identity Manager runs can exploit the issue to gain unauthorized read access to critical data. Successful exploitation yields complete access to data accessible by Oracle Identity Manager without impacting integrity or availability.

Critical Impact

Unauthorized disclosure of all data accessible to Oracle Identity Manager by a locally authenticated low-privileged user.

Affected Products

  • Oracle Identity Manager 12.2.1.4.0
  • Oracle Identity Manager 14.1.2.1.0
  • Component: Installer

Discovery Timeline

Technical Details for CVE-2026-91501

Vulnerability Analysis

The vulnerability resides in the Installer component of Oracle Identity Manager. An attacker who already holds a local account on the host where Oracle Identity Manager executes can leverage the installer logic to read data that the Identity Manager process can access. The flaw does not require user interaction and does not cross a security scope boundary.

Because Oracle Identity Manager stores and processes identity records, credentials metadata, and provisioning data, exposure of this data has downstream implications for the broader identity fabric. The attack is confidentiality-only; the issue does not permit modification or service disruption through this vector.

Root Cause

Oracle has not published a detailed root-cause breakdown in the advisory. The weakness is characterized as an information exposure issue in the Installer component, exploitable from a local logon session with low privileges. Refer to the Oracle Security Alert - October 2026 for vendor-authored technical context.

Attack Vector

The attacker requires local logon to the Oracle Identity Manager host and a low-privilege account. From that session, the attacker interacts with Installer-component resources to retrieve data accessible to the Identity Manager runtime. No social engineering or additional authentication is needed. Exploitation complexity is low, which makes host-level account hygiene the key defensive control.

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-91501

Indicators of Compromise

  • Unexpected local-user access to Oracle Identity Manager installation directories or installer artifacts.
  • Reads of configuration or credential-adjacent files by accounts that do not operate the Identity Manager service.
  • Unusual process executions originating from low-privileged shell sessions on the Identity Manager host.

Detection Strategies

  • Audit file-system access on Oracle Identity Manager hosts, with emphasis on Installer directories and configuration stores.
  • Correlate interactive logon events with subsequent file reads against Identity Manager paths.
  • Baseline the accounts that legitimately interact with the Installer component and alert on deviations.

Monitoring Recommendations

  • Forward operating-system audit logs and Oracle Identity Manager application logs to a centralized analytics platform.
  • Monitor local account creation and privilege changes on hosts running Oracle Fusion Middleware.
  • Review session recordings or shell history for low-privileged users who touch Identity Manager binaries or configuration files.

How to Mitigate CVE-2026-91501

Immediate Actions Required

  • Apply the fixes referenced in the Oracle Critical Patch Update - October 2026 to Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0.
  • Inventory all local accounts on Identity Manager hosts and remove accounts that are not required for operations.
  • Restrict interactive logon rights on Identity Manager servers to administrators and service accounts.

Patch Information

Oracle addressed the vulnerability in its October 2026 Critical Patch Update. Administrators should download the patch bundle corresponding to their deployed version (12.2.1.4.0 or 14.1.2.1.0) and follow the Oracle Fusion Middleware patch application procedure in a validated non-production environment before promotion.

Workarounds

  • Enforce the principle of least privilege and remove shell access for non-administrative users on Identity Manager hosts.
  • Harden file-system permissions on Oracle Identity Manager installation directories so only the service account and administrators can read them.
  • Isolate Oracle Identity Manager infrastructure on dedicated hosts without shared tenancy from unrelated users or workloads.
bash
# Configuration example: restrict access to Oracle Identity Manager install directory
chown -R oracle:oinstall /u01/app/oracle/middleware/idm
chmod -R 750 /u01/app/oracle/middleware/idm
# Verify no unauthorized local accounts have shell access
awk -F: '($7 !~ /nologin|false/) {print $1, $7}' /etc/passwd

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne