---
id: "CVE-2026-91259"
kind: "vulnerability"
aliases: ["CVE-2026-91259"]
title: "Oracle Identity Manager: low-privilege HTTP attacker can take over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Identity Manager", "fixed": ["October 2026 CPU patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.1.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-fusion-middleware", "oracle-identity-manager", "other", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "versions-outside-affected-list"]
published_at: "2026-10-20T22:20:26+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:58:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91259", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:58:31+00:00"}]
---

# Oracle Identity Manager: low-privilege HTTP attacker can take over server

Oracle Identity Manager's OIM Legacy UI component has a flaw in 12.2.1.4.0 and 14.1.2.1.0. An attacker with a low-privilege account and network access over HTTP can take over OIM, with no user interaction (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). Oracle fixed it in the October 2026 Critical Patch Update. No exploitation or public PoC is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Identity Manager affected 12.2.1.4.0, 14.1.2.1.0 fixed October 2026 CPU patch (number unknown)

## How to check

Check whether you run Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 (for example with OPatch lsinventory in the OIM Oracle home). Then check whether the OIM Legacy UI is reachable over HTTP from untrusted networks or by any low-privilege account. Oracle's public text does not say whether the Legacy UI is enabled by default, so this is unknown.

## Fix

Apply the October 2026 Oracle Critical Patch Update for Oracle Identity Manager from My Oracle Support. The specific patch number is not public (see the Fusion Middleware patch availability document linked from the CPU). Until then, restrict network access to the OIM Legacy UI to trusted admin networks.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91259
- 2026-10-23T23:58:31+00:00 analyst — Fixed in Oracle's October 2026 CPU (released 2026-10-20), not April as the triage note guessed. The CPU lists OIM 12.2.1.4.0 and 14.1.2.1.0 under Fusion Middleware. CVE.org and Armis confirm CVSS 8.8 and the OIM Legacy UI component. No patch number or fixed version in public pages (it is behind My Oracle Support). No exploitation reported (not in KEV per Armis). I found no PoC. I did not search X or HN because the product is obscure and the id is new.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record: CVE-2026-91259 https://www.cve.org/CVERecord?id=CVE-2026-91259
- [mentions] Armis: CVE-2026-91259 https://cve.armis.com/CVE-2026-91259

## From the sources

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_