CVE-2026-91492: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-91492 is an authorization bypass vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically affecting the SAP ERP+ component. It affects versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit this difficult-to-exploit flaw to compromise the connector, with attacks potentially impacting additional connected Oracle products (scope change). It carries a CVSS v3.1 base score of 8.7 (High) (Oracle Advisory).

The vulnerability is classified as an authorization bypass (CWE not explicitly specified, but characterized as an authorization bypass by Feedly threat intelligence). The attack vector is network-based via HTTP, requires no privileges and no user interaction, but is rated High complexity, meaning exploitation requires specific conditions or circumstances to be met. A successful attack results in a scope change, meaning the impact extends beyond the Oracle Identity Manager Connector itself to potentially affect other connected Oracle products. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Identity Manager Connector, as well as complete unauthorized read access to all data accessible by the connector. Due to the scope change, connected Oracle products and systems integrated via the SAP ERP+ component may also be compromised, raising the risk of lateral movement across identity management infrastructure. There is no availability impact identified; the primary risks are to confidentiality and integrity (Oracle Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is reported as 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity requirement reduces the immediate risk of opportunistic exploitation (Oracle Advisory).

Oracle has released patches for affected versions (12.2.1.4.0 and 14.1.2.1.0) as part of the October 2026 Critical Patch Update (CPU). Oracle strongly recommends applying the CPU patches as soon as possible. As a temporary measure, organizations can implement network access controls to restrict HTTP access to the Oracle Identity Manager Connector to trusted systems only, and monitor connector logs for suspicious or unauthorized access attempts. Blocking network protocols required by the attack may reduce risk but is not a long-term solution (Oracle Advisory).