CVE-2026-91501: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-91501 is a local file/data disclosure vulnerability in the Installer component of Oracle Identity Manager, part of Oracle Fusion Middleware. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows a low-privileged local attacker with logon access to the infrastructure where Oracle Identity Manager executes to gain unauthorized access to critical or all application-accessible data. It carries a CVSS v3.1 base score of 5.5 (Medium) (Oracle Advisory).

The vulnerability resides in the Installer component of Oracle Identity Manager and is classified as a local information disclosure issue (CWE category: improper access control or insecure file permissions during installation). The attack vector is local (AV:L), requires low privileges (PR:L), low attack complexity (AC:L), and no user interaction (UI:N). An attacker with a local OS account on the host where Oracle Identity Manager runs can exploit this flaw to read critical data accessible to the application, with no impact on integrity or availability. No public technical write-ups or proof-of-concept code have been identified (Oracle Advisory).

Successful exploitation results exclusively in a confidentiality impact — specifically, unauthorized read access to critical data or complete access to all data accessible by Oracle Identity Manager. Since Oracle Identity Manager is an identity governance platform managing user accounts, roles, and credentials across enterprise systems, exposure of its data could include sensitive identity records, provisioning configurations, and potentially credential material, increasing the risk of downstream privilege escalation or lateral movement. Integrity and availability are not affected (Oracle Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires local access to the infrastructure, which limits the exploitable attack surface to insiders or attackers who have already achieved a foothold on the host (Oracle Advisory).

Oracle released a patch for this vulnerability as part of the October 2026 Critical Patch Update (CPU), published on October 20, 2026, addressing both affected versions (12.2.1.4.0 and 14.1.2.1.0). Oracle strongly recommends applying the CPU patches as soon as possible. As interim mitigations, organizations should restrict local logon access to the Oracle Identity Manager host to only authorized personnel, enforce least-privilege access controls for system accounts, and monitor access to Oracle Identity Manager data repositories for unauthorized activity (Oracle Advisory).