External risk intelligence

Oracle Identity Manager End User Self Service Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-91408

Oracle Identity Manager is an identity and access management product. The End User Self Service component is typically exposed to facilitate user tasks, and the vulnerability is accessible over network protocols like T3 and IIOP, making it a common target for external network reachability in enterprise identity deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Identity Manager, a component of Oracle Fusion Middleware. This issue could allow an unauthenticated attacker with network access to completely take over the system, potentially impacting confidentiality, integrity, and availability.

Unauthenticated attackers can compromise Identity Manager.
This system manages user access and identities.
Confirm relevance and exposure of Identity Manager.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target the End User Self Service component of Oracle Identity Manager over network protocols like T3 or IIOP. This exposure allows them to trigger a vulnerability that can lead to a complete takeover of the Oracle Identity Manager system, impacting its confidentiality, integrity, and availability.

Network access required.
Vulnerable component triggered remotely.
Full system takeover possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to gain complete control over Oracle Identity Manager, potentially affecting the management of user identities and access privileges within the affected environment. This is possible when the system is accessible over a network using specific protocols.

User identity and access data at risk.
Attacker gains administrative control.
Compromise of identity management services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle Identity Manager's End User Self Service component requires immediate attention from teams managing identity and access solutions. The first practical step is to confirm the presence of the affected Oracle Identity Manager versions, assess their network exposure and business criticality, and identify the specific application or platform owners accountable for remediation. A risk-based plan should then be developed, potentially involving vendor coordination and maintenance window scheduling.

Identify and confirm accountable application owners.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Identity Manager and its End User Self Service component?

Oracle Identity Manager is part of Oracle Fusion Middleware designed to manage user identities, access rights, and lifecycle tasks across an enterprise. The End User Self Service component specifically provides a web-based interface allowing employees to perform routine tasks like password resets or profile updates. Because this component interacts with the central identity store, it must be robust against unauthorized access to maintain the security of the entire organization.

What does this CVE-2026-91408 vulnerability mean for the software?

This vulnerability represents a critical security weakness that allows an attacker to bypass authentication mechanisms. By exploiting this flaw in the End User Self Service component, an attacker can gain full control over the Oracle Identity Manager system. This creates a complete loss of confidentiality, integrity, and availability, meaning the attacker could potentially view, modify, or delete sensitive user data and administrative configurations.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by sending specifically crafted network traffic to the Oracle Identity Manager environment. The attack utilizes the T3 or IIOP protocols to interact with the vulnerable component remotely. Importantly, this does not require a user to log in first; the system is susceptible even if the attacker has no valid credentials. Simply having network reachability to these service ports is sufficient for an attempt.

Why should I care about this vulnerability based on Halo Surface Signal?

Halo Surface Signal indicates that Oracle Identity Manager is often intentionally made accessible over the network to support user tasks, which unfortunately aligns with the requirements for this attack. Because this vulnerability is reachable via standard protocols like T3 and IIOP, systems that are exposed to broader network segments or the internet are at much higher risk than those isolated in highly restricted internal segments.

What should I do if I run this technology?

Your first step is to verify if you are running version 12.2.1.4.0 or 14.1.2.1.0 of Oracle Identity Manager. Once identified, map out where these instances exist on your network and determine which business processes depend on them. Coordinate with the designated application owners to assess the risk of exposure and prepare for maintenance activities. Review official security updates from Oracle to plan your path toward resolving the underlying flaw.

References

www.oracle.com/security-alerts/cpuoct2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.