Oracle OIM Connector CVE-2026-91492

Requires network HTTP access to an Oracle Identity Manager deployment running the SAP ERP+ connector on affected versions 12.2.1.4.0 or 14.1.2.1.0; no authentication is needed (PR:N) and no user interaction is required (UI:N). Exploitation is LIMITED by high attack complexity (AC:H) - Oracle explicitly labels it 'difficult to exploit,' indicating a required condition outside the attacker's control (e.g., a timing/race window or specific environmental state) must be met. Realistic exposure is further limited to environments that actually deploy the SAP ERP+ connector and expose its HTTP interface to attacker-reachable networks; internally-segmented connector instances are substantially harder to reach.

This is a genuinely serious but not top-tier-urgent issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, base 8.7) confirms a network-reachable, unauthenticated flaw (PR:N) with high confidentiality and integrity impact and a scope change, meaning compromise of the Oracle Identity Manager SAP ERP+ connector can cascade into additional connected products (notably the downstream identity/SAP environment). The key mitigating signal is AC:H - Oracle rates this 'difficult to exploit,' implying the attacker must win a race, defeat a non-trivial precondition, or control factors outside their direct influence, which meaningfully lowers mass-exploitation likelihood. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is currently no evidence of active or imminent widespread exploitation (no public exploit identified at time of analysis). Note a conflict to verify: the input Tags include 'Authentication Bypass,' but the Oracle description characterizes the flaw as a scope-changing data-integrity/confidentiality compromise by an already-unauthenticated attacker rather than an explicit auth-bypass primitive - treat the tag as unconfirmed and rely on the CVSS vector. Net: a real priority for IAM/SAP integration teams because of the unauthenticated network reach, scope change, and C:H/I:H, but the high attack complexity and absence of exploitation signals place it below 'drop-everything' status.

An unauthenticated attacker with network HTTP access to an exposed Oracle Identity Manager SAP ERP+ connector endpoint sends crafted requests that, after satisfying a difficult-to-meet precondition (AC:H), let them read or alter critical identity data. Because of the scope change, the attacker leverages the connector's trusted integration to pivot into additional connected products such as the SAP ERP target system. No public proof-of-concept exploit is known at the time of analysis.