CVE-2026-91211
HighCVSS 8.7Summary
Vulnerability in Oracle Identity Manager Connector (Connectors and Connector Server component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable flaw allows a high-privileged attacker with SOAP network access to unauthorized creation, deletion, or modification of critical data.
Risk Assessment
A high-privileged attacker could modify or delete data and access all Oracle Identity Manager Connector data, with scope change potentially impacting other products. The high CVSS score of 8.7 indicates serious confidentiality and integrity risk.
Recommendation
Immediately apply Oracle security updates for versions 12.2.1.4.0 and 14.1.2.1.0. Restrict access to the SOAP interface and review privileges of high-privileged accounts.
Other vulnerabilities in Oracle Identity Manager Connector
See all- CVE-2026-91494High
Vulnerability in the LDAP Gateway component of Oracle Identity Manager Connector (Oracle Fusion Middleware). An unauthenticated attacker can exploit it over the network via TCP to gain unauthorized creation, deletion or modification access to critical data and full access to connector data; exploitation is difficult. CVSS 7.4.
- CVE-2026-91493High
Vulnerability in the LDAP Gateway component of Oracle Identity Manager Connector (Oracle Fusion Middleware). An unauthenticated attacker can exploit it over the network via LDAP to gain unauthorized access to critical connector data. CVSS 7.5.
- CVE-2026-91492High
Vulnerability in the SAP ERP+ component of Oracle Identity Manager Connector (Oracle Fusion Middleware). An unauthenticated attacker can exploit it over the network via HTTP to gain unauthorized creation, deletion or modification access to critical data and full access to connector data; exploitation is difficult and impact may extend beyond the connector (scope change). CVSS 8.7.
- CVE-2026-91489High
Vulnerability in the LDAP Gateway component of Oracle Identity Manager Connector (Oracle Fusion Middleware). A low privileged attacker with local logon to the infrastructure can gain unauthorized creation, deletion or modification access to critical data and full access to connector data. CVSS 7.1.
- CVE-2026-91488High
Vulnerability in the Generic REST component of Oracle Identity Manager Connector (Oracle Fusion Middleware). A low privileged attacker with local logon to the infrastructure can gain unauthorized creation, deletion or modification access to critical data and full access to connector data. CVSS 7.1.
- CVE-2026-91212High
Vulnerability in Oracle Identity Manager Connector (Generic REST component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to critical data.
- CVE-2017-10270High
A vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory) allows easy exploitation by an unauthenticated attacker with access to the infrastructure where Oracle Identity Manager Connector operates. Attacks can lead to unauthorized access to critical data and may cause system crashes.
- CVE-2026-91491Critical
Vulnerability in Oracle Identity Manager Connector (LDAP Gateway component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via LDAP can take over Oracle Identity Manager Connector. CVSS 9.8.
- CVE-2026-91490Critical
Vulnerability in Oracle Identity Manager Connector (LDAP Gateway component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via LDAP can create, delete, or modify critical data and gain unauthorized access to it. CVSS 9.1.
- CVE-2026-83027Critical
Vulnerability in Oracle Identity Manager Connector (Core component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with access to the physical communication segment attached to the hardware running Oracle Identity Manager Connector can gain unauthorized access to data, including creation, deletion, and modification.
Original NVD description (English source)
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS