CVE-2026-91408

Summary

This vulnerability allows unauthenticated attackers to fully compromise Oracle Identity Manager through T3 or IIOP protocols, affecting versions 12.2.1.4.0 and 14.1.2.1.0. The flaw enables complete takeover of the system with high impact on confidentiality, integrity, and availability.

Exploitability

The vulnerability is easily exploitable with no authentication required, allowing attackers to compromise Oracle Identity Manager through network access using T3 or IIOP protocols.

Blast radius

Successful exploitation could lead to full compromise of identity management infrastructure, potentially affecting thousands of users and their access rights across the organization.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Immediate remediation is to upgrade to Oracle Fusion Middleware 12.2.1.4.0 or 14.1.2.1.0 with the latest patches for Oracle Identity Manager, as these versions contain fixes for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.