Oracle IDM Connector CVE-2026-91211

Exploitation requires the attacker to already hold high privileges within Oracle Identity Manager (CVSS PR:H) and network access to the Connectors and Connector Server component via SOAP; affected products are Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. The primary limiting factor is the high-privilege prerequisite - this cannot be triggered by an unauthenticated or low-privileged remote attacker - while the scope change (S:C) means successful exploitation can extend impact beyond the connector into additional products. No user interaction is required and attack complexity is low once the privilege and SOAP-access conditions are met.

This is a genuine but conditionally-gated risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, 8.7) shows network reachability over SOAP with low attack complexity and no user interaction, and a scope change that lets impact spill into additional products - all serious. However, PR:H is the decisive limiter: the attacker must already hold high privileges within the Oracle Identity Manager environment, so this is a privilege-abuse/lateral-movement-and-escalation issue, not an anonymous internet-facing takeover. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a signal conflict worth verifying: the input Tags include 'Authentication Bypass,' which contradicts the PR:H vector and the description's 'high privileged attacker' language - the Oracle description does not describe an authentication bypass, so treat that tag as suspect and rely on the CVSS vector. Net: a real high-severity patch-priority item for organizations running affected Oracle IAM, but the high-privilege prerequisite makes mass, widespread exploitation unlikely absent a prior foothold.

An attacker who has already obtained high-privileged credentials or a compromised privileged account on an Oracle Identity Manager deployment sends crafted SOAP requests over the network to the Connectors/Connector Server component. Because exploitation is low-complexity and triggers a scope change, the attacker can read, create, delete, or modify critical identity data and pivot to significantly impact additional connected products. No public exploit code is identified at time of analysis.