{"id":"CVE-2026-91211","kind":"vulnerability","aliases":["CVE-2026-91211"],"related":[],"title":"Oracle Identity Manager Connector: privileged SOAP attacker can modify critical data","description":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).","summary":"Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 have a flaw in the Connectors and Connector Server component reachable over SOAP. An attacker with high privileges on the network can create, change, or delete critical data and read data the connector can access, with the impact spreading beyond the connector itself.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Identity Manager Connector","fixed":[],"affected":"12.2.1.4.0, 14.1.2.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-identity-manager","self-hosted","vendor"],"not_affected_if":["auth-required"],"how_to_check":"Run OPatch lsinventory in the Oracle Identity Manager Connector / Connector Server Oracle home and check whether the version is 12.2.1.4.0 or 14.1.2.1.0, and whether the October 2026 CPU patch is applied. Exposure needs a high-privileged account with network access to the SOAP interface of the Connector Server.","fix":"Apply the October 2026 Critical Patch Update for Oracle Identity Manager Connector (Fusion Middleware patch availability document on My Oracle Support). Patch number: unknown, it needs an MOS login. Until patched, limit network access to the connector SOAP endpoints and review high-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:21+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:37:04+00:00","updated_at":"2026-10-23T23:59:22+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-10-23T22:37:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Identity Manager Connector: privileged SOAP attacker can modify critical data","impact":"high","summary":"Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 have a flaw in the Connectors and Connector Server component reachable over SOAP. An attacker with high privileges on the network can create, change, or delete critical data and read data the connector can access, with the impact spreading beyond the connector itself.","category":"vendor","who_cares":["oracle-identity-manager","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker with admin-level access modifies or deletes identity data","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-91211 to get patch versions and any check steps; the NVD entry gives none.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000513,"input_tokens":3170,"output_tokens":393,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-91211 to get patch versions and any check steps; the NVD entry gives none.","search":"'-2026':13A,16A '-91211':14A,17A '/av':202C '12.2.1.4.0':39B,107C '14.1.2.1.0':41B,109C '3.1':190C,201C '8.7':193C 'access':76B,119C,158C,168C,174C,180C,187C 'addit':141C 'affect':105C 'allow':113C 'attack':7A,56B,116C,137C,146C 'base':191C 'beyond':81B 'c/c':207C 'chang':65B,144C 'complet':179C 'compon':51B,96C 'compromis':123C 'confidenti':194C 'connector':4A,21A,37B,47B,49B,74B,83B,90C,97C,99C,127C,136C,167C,186C 'creat':64B 'creation':154C 'critic':10A,68B,160C,176C 'cve':12A,15A 'cvss':189C,198C,200C 'data':11A,69B,72B,161C,169C,177C,188C 'delet':67B,155C 'easili':110C 'exploit':111C 'flaw':44B 'fusion':24B,94C 'h/a':209C 'h/i':208C 'h/ui':205C 'high':58B,114C 'host':32B 'ident':2A,28B,35B,88C,125C,134C,165C,184C 'identity':19A 'impact':79B,140C,197C 'integr':196C 'l/pr':204C 'manag':3A,29B,36B,89C,126C,135C,166C,185C 'manager':20A 'may':138C 'middlewar':25B,95C 'modif':157C 'modifi':9A 'n':210C 'n/ac':203C 'n/s':206C 'network':62B,118C 'oracl':1A,23B,27B,34B,87C,93C,124C,133C,164C,183C 'oracle':18A 'oracle-fusion-middlewar':22B 'oracle-identity-manag':26B 'privileg':5A,59B,115C 'product':91C,142C 'reachabl':52B 'read':71B 'result':151C 'scope':143C 'score':192C 'self':31B 'self-host':30B 'server':50B,100C 'signific':139C 'soap':6A,54B,121C 'spread':80B 'success':145C 'support':101C 'unauthor':153C,173C 'vector':199C 'vendor':33B 'version':38B,102C 'via':120C 'vulner':84C,112C,130C,149C 'well':171C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91211","severity":null,"published_at":"2026-10-20T22:20:21+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91211:563","url":null,"severity":null,"published_at":"2026-10-23T23:59:22+00:00","modified_at":"2026-10-23T23:59:22+00:00","first_seen_at":"2026-10-23T23:59:22+00:00","fetched_at":"2026-10-23T23:59:22+00:00","note":"Oracle CPU Oct 2026 (2026-10-19/20) lists Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 as affected. Patch numbers sit in the Fusion Middleware patch availability doc on My Oracle Support (login required), so exact patch IDs are unknown. No exploitation or PoC reported; social search not done (no CVE-specific chatter expected)."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2292,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91211","title":"CVE Record: CVE-2026-91211","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}