CVE-2026-91501

MediumCVSS 5.5

Published: 20/10/2026(UTC)Updated: 24/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

Vulnerability in the Installer component of Oracle Identity Manager (Oracle Fusion Middleware) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to gain unauthorized access to critical data or all data accessible in Oracle Identity Manager.

Risk Assessment

An attacker with basic local privileges can access sensitive data of the identity management system, potentially leading to privilege escalation and confidentiality breaches across the organization.

Recommendation

Apply the security updates provided by Oracle for the Installer component and restrict local access to the Oracle Identity Manager infrastructure to trusted administrators only.

Other vulnerabilities in Oracle Identity Manager

See all

Original NVD description (English source)

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager executes to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS