Oracle Identity Manager CVE-2026-91408

Exploitation requires network reachability to the WebLogic T3 and/or IIOP listener ports fronting Oracle Identity Manager (End User Self Service component) on affected versions 12.2.1.4.0 or 14.1.2.1.0. No authentication, no user interaction, and no non-default configuration are needed (PR:N/UI:N, 'easily exploitable' per Oracle), so default deployments are vulnerable. The primary limiting factor is network exposure: T3/IIOP are internal administrative/clustering protocols that should not be internet-facing, so risk is sharply reduced where these ports are firewalled or restricted to trusted management segments, and highest where IDM is directly reachable.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction and yielding full confidentiality, integrity, and availability loss - Oracle explicitly states it results in 'takeover of Oracle Identity Manager.' The specified attack surface (the T3 and IIOP protocols) is characteristic of the underlying WebLogic application server and is strongly associated with Java deserialization RCE, consistent with the 9.8 takeover rating. Signals that are MISSING weaken only the urgency timeline, not the severity: no EPSS score was provided, the CVE is NOT on CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis. The absence of EPSS/KEV/POC data should be read as 'not yet observed/not supplied,' not as evidence of low risk - Oracle Identity Manager is an identity-and-access management system whose compromise cascades into broader credential and provisioning abuse, so defenders should treat it as critical and patch on the emergency track regardless of the quiet exploitation signals.

An attacker with network reachability to the WebLogic T3 or IIOP listener fronting Oracle Identity Manager sends a crafted protocol message (typically a malicious serialized Java object) to the End User Self Service component. Because no authentication or user interaction is required and attack complexity is low, the payload is processed by the server and leads to code execution and full product takeover. No public exploit is referenced for this specific CVE, but T3/IIOP deserialization attack tooling against WebLogic is well established.