{"id":"CVE-2026-91408","kind":"vulnerability","aliases":["CVE-2026-91408"],"related":[],"title":"Oracle Identity Manager: unauthenticated takeover over T3 and IIOP","description":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Identity Manager's End User Self Service component, in versions 12.2.1.4.0 and 14.1.2.1.0, can be compromised by an unauthenticated attacker over the network through T3 or IIOP. A successful attack lets the attacker take over the Oracle Identity Manager server.","severity":"critical","cvss":9.8,"epss":0.00355,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Identity Manager","fixed":["unknown: October 2026 CPU patch"],"affected":"12.2.1.4.0, 14.1.2.1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oracle-fusion-middleware","oracle-identity-manager","runtime","self-hosted","weblogic"],"not_affected_if":["default-config","t3-iiop-not-reachable"],"how_to_check":"Check your OIM version (12.2.1.4.0 or 14.1.2.1.0 are affected). Check whether WebLogic T3/IIOP ports of the OIM managed server are reachable from untrusted networks. Confirm the October 2026 CPU patch is applied with OPatch lsinventory.","fix":"Apply the October 2026 Critical Patch Update for Oracle Identity Manager (patch numbers in the Oracle Fusion Middleware patch availability document on My Oracle Support). Until then, block T3/IIOP to OIM servers from untrusted networks, for example with a WebLogic connection filter.","status":"open","published_at":"2026-10-20T22:20:44+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:33:59+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"runtime","confidence":0.55,"triage":{"at":"2026-10-23T22:33:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Identity Manager: unauthenticated takeover over T3 and IIOP","impact":"high","summary":"Oracle Identity Manager's End User Self Service component, in versions 12.2.1.4.0 and 14.1.2.1.0, can be compromised by an unauthenticated attacker over the network through T3 or IIOP. A successful attack lets the attacker take over the Oracle Identity Manager server.","category":"runtime","who_cares":["oracle-identity-manager","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over the Identity Manager server over the network without credentials","analyst_note":"Find Oracle's advisory and patch list for CVE-2026-91408 and check whether T3/IIOP exposure is a default or needs enabling; the sources do not give a fix version or check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000506,"input_tokens":3096,"output_tokens":392,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's advisory and patch list for CVE-2026-91408 and check whether T3/IIOP exposure is a default or needs enabling; the sources do not give a fix version or check.","search":"'-2026':11A,14A '-91408':12A,15A '/av':142C '12.2.1.4.0':43B,95C '14.1.2.1.0':45B,97C '3.1':129C,141C '9.8':132C 'access':106C 'affect':93C 'allow':101C 'attack':52B,62B,65B,103C,116C 'avail':136C 'base':130C 'compon':40B,84C 'compromis':48B,111C 'confidenti':133C 'cve':10A,13A 'cvss':128C,138C,140C 'easili':98C 'end':36B,85C 'exploit':99C 'fusion':21B,82C 'h':150C 'h/a':149C 'h/i':148C 'host':30B 'ident':2A,25B,33B,70B,77C,113C,126C 'identity':17A 'iiop':9A,59B,109C 'impact':137C 'integr':134C 'l/pr':144C 'let':63B 'manag':3A,26B,34B,71B,78C,114C,127C 'manager':18A 'middlewar':22B,83C 'n/ac':143C 'n/s':146C 'n/ui':145C 'network':55B,105C 'oracl':1A,20B,24B,32B,69B,76C,81C,112C,125C 'oracle':16A 'oracle-fusion-middlewar':19B 'oracle-identity-manag':23B 'product':79C 'result':121C 'runtim':27B 'score':131C 'self':29B,38B,87C 'self-host':28B 'server':72B 'servic':39B,88C 'success':61B,115C 'support':89C 't3':7A,57B,108C 'take':66B 'takeov':5A,123C 'u/c':147C 'unauthent':4A,51B,102C 'user':37B,86C 'vector':139C 'version':42B,90C 'via':107C 'vulner':73C,100C,119C 'weblog':31B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91408","severity":null,"published_at":"2026-10-20T22:20:44+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91408:333","url":null,"severity":null,"published_at":"2026-10-23T22:57:21+00:00","modified_at":"2026-10-23T22:57:21+00:00","first_seen_at":"2026-10-23T22:57:21+00:00","fetched_at":"2026-10-23T22:57:21+00:00","note":"Oracle October 2026 CPU lists Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware patch doc, behind My Oracle Support login). Fixed patch/version number and whether T3/IIOP is on by default not read; no public PoC or exploitation found in a search. Settle by reading the MOS patch availability document for Fusion Middleware."},{"source":"epss","external_id":"CVE-2026-91408","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91408","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}