Oracle IDM Connector CVE-2026-91212

Requires network reachability to the Generic REST interface of Oracle Identity Manager Connector (versions 12.2.1.4.0 or 14.1.2.1.0); exploitation is unauthenticated (PR:N), needs no user interaction (UI:N), and works against standard deployments over HTTP. The principal limiting factor is network exposure: the connector's REST endpoint must be reachable by the attacker, so deployments that isolate the IAM tier behind strict network segmentation materially reduce exposure. Impact is confined to confidentiality (critical data disclosure), with no integrity or availability effect, though the scope change means disclosed access may extend to additional integrated products.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - the easiest possible exploitation profile - against an enterprise identity-management component. The scope change (S:C) and Oracle's own note that 'attacks may significantly impact additional products' are the most concerning signals: a confidentiality breach here can cascade beyond the connector into other identity-governed systems, which is especially dangerous in an IAM product that brokers access to many downstream applications. Impact is confidentiality-only (C:H, I:N, A:N), so this is a data-exposure flaw, not a tampering or denial-of-service flaw. Key signals are MISSING and must be stated plainly: no EPSS score was provided, so exploitation probability cannot be quantified; KEV status is not listed (treat as not actively exploited per CISA at this time); and no public POC is indicated. The 'Authentication Bypass' tag is consistent with PR:N but is not independently confirmed by the vendor text, which only states the attacker is unauthenticated. Net: prioritize patching via the referenced Oracle CPU due to the unauthenticated-network-plus-scope-change profile, while recognizing that real-world exploitation volume is unquantified absent EPSS/KEV/POC data.

A remote, unauthenticated attacker sends crafted HTTP requests to the internet- or network-exposed Generic REST interface of Oracle Identity Manager Connector and retrieves critical data it can access. Because the flaw carries a scope change, the exposed data or access can extend into other Oracle Identity Manager-integrated products beyond the connector itself. No public exploit identified at time of analysis, so this scenario is derived from the CVSS vector rather than a demonstrated exploit.