---
id: "CVE-2026-91408"
kind: "vulnerability"
aliases: ["CVE-2026-91408"]
title: "Oracle Identity Manager: unauthenticated takeover over T3 and IIOP"
severity: "critical"
cvss: 9.8
epss: 0.00355
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Identity Manager", "fixed": ["unknown: October 2026 CPU patch"], "affected": "12.2.1.4.0, 14.1.2.1.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle-fusion-middleware", "oracle-identity-manager", "runtime", "self-hosted", "weblogic"]
not_affected_if: ["default-config", "t3-iiop-not-reachable"]
published_at: "2026-10-20T22:20:44+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91408", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:57:21+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91408", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Identity Manager: unauthenticated takeover over T3 and IIOP

Oracle Identity Manager's End User Self Service component, in versions 12.2.1.4.0 and 14.1.2.1.0, can be compromised by an unauthenticated attacker over the network through T3 or IIOP. A successful attack lets the attacker take over the Oracle Identity Manager server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Identity Manager affected 12.2.1.4.0, 14.1.2.1.0 fixed unknown: October 2026 CPU patch

## How to check

Check your OIM version (12.2.1.4.0 or 14.1.2.1.0 are affected). Check whether WebLogic T3/IIOP ports of the OIM managed server are reachable from untrusted networks. Confirm the October 2026 CPU patch is applied with OPatch lsinventory.

## Fix

Apply the October 2026 Critical Patch Update for Oracle Identity Manager (patch numbers in the Oracle Fusion Middleware patch availability document on My Oracle Support). Until then, block T3/IIOP to OIM servers from untrusted networks, for example with a WebLogic connection filter.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91408
- 2026-10-23T22:57:21+00:00 analyst — Oracle October 2026 CPU lists Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware patch doc, behind My Oracle Support login). Fixed patch/version number and whether T3/IIOP is on by default not read; no public PoC or exploitation found in a search. Settle by reading the MOS patch availability document for Fusion Middleware.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91408

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html

## From the sources

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_