{"id":"CVE-2026-91489","kind":"vulnerability","aliases":["CVE-2026-91489"],"related":[],"title":"Oracle Identity Manager Connector: LDAP Gateway flaw lets local users read and change data","description":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","summary":"An LDAP Gateway component of the Oracle Identity Manager Connector in Oracle Fusion Middleware has a flaw that lets a low-privileged user on the host compromise the connector. A successful attack allows unauthorized creation, modification, deletion and reading of data the connector can access.","severity":"high","cvss":7.1,"epss":0.00104,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity-management","ldap","oracle-fusion-middleware","oracle-identity-manager","other"],"not_affected_if":["no-ldap-gateway","other-versions"],"how_to_check":"- Identify whether Oracle Identity Manager Connector is installed and check its version against `12.2.1.4.0` and `14.1.2.1.0`\n- Confirm whether the LDAP Gateway component is deployed on the host","fix":"- Apply the Oracle Critical Patch Update for Oracle Identity Manager Connector (fixed release not named in the sources; unknown)","status":"open","published_at":"2026-10-20T22:20:53+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:34:06+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:34:06Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for Oracle Identity Manager Connector (fixed release not named in the sources; unknown)","reach":"local","title":"Oracle Identity Manager Connector: LDAP Gateway flaw lets local users read and change data","impact":"high","summary":"An LDAP Gateway component of the Oracle Identity Manager Connector in Oracle Fusion Middleware has a flaw that lets a low-privileged user on the host compromise the connector. A successful attack allows unauthorized creation, modification, deletion and reading of data the connector can access.","category":"other","nicknames":[],"who_cares":["oracle-identity-manager","oracle-fusion-middleware","identity-management","ldap"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads and modifies all data the connector can access","analyst_note":"Find the Oracle security alert or CPU advisory for the patched release and the exact fixed version; sources give only affected versions.","how_to_check":"- Identify whether Oracle Identity Manager Connector is installed and check its version against `12.2.1.4.0` and `14.1.2.1.0`\n- Confirm whether the LDAP Gateway component is deployed on the host","needs_analyst":true,"not_affected_if":["other-versions","no-ldap-gateway"],"who_is_affected":"Teams running Oracle Identity Manager Connector versions 12.2.1.4.0 or 14.1.2.1.0 with the LDAP Gateway component. The attacker needs a logon on the infrastructure where the connector runs, so exposure is mainly from local or internal accounts. Systems without these versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3555,"output_tokens":616,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91489':17A,20A '/av':184C '12.2.1.4.0':100C '14.1.2.1.0':102C '3.1':172C,183C '7.1':175C 'access':78B,140C,150C,156C,162C,169C 'affect':98C 'allow':66B,106C 'attack':65B,109C,128C 'base':173C 'chang':13A 'complet':161C 'compon':36B,91C 'compromis':60B,122C 'confidenti':176C 'connector':4A,42B,62B,76B,85C,119C,126C,149C,168C 'creation':68B,136C 'critic':142C,158C 'cve':15A,18A 'cvss':171C,180C,182C 'data':14A,74B,143C,151C,159C,170C 'delet':70B,137C 'easili':103C 'execut':120C 'exploit':104C 'flaw':7A,49B 'fusion':27B,45B,89C 'gateway':6A,35B,93C 'h/a':191C 'h/i':190C 'host':59B 'ident':2A,22B,31B,40B,83C,117C,124C,147C,166C 'identity-manag':21B 'impact':179C 'infrastructur':114C 'integr':178C 'l/ac':185C 'l/pr':186C 'l/ui':187C 'ldap':5A,24B,34B,92C 'let':8A,51B 'local':9A 'logon':111C 'low':54B,107C 'low-privileg':53B 'manag':3A,23B,32B,41B,84C,118C,125C,148C,167C 'middlewar':28B,46B,90C 'modif':69B,139C 'n':192C 'n/s':188C 'oracl':1A,26B,30B,39B,44B,82C,88C,116C,123C,146C,165C 'oracle-fusion-middlewar':25B 'oracle-identity-manag':29B 'privileg':55B,108C 'product':86C 'read':11A,72B 'result':133C 'score':174C 'success':64B,127C 'support':94C 'u/c':189C 'unauthor':67B,135C,155C 'user':10A,56B 'vector':181C 'version':95C 'vulner':79C,105C,131C 'well':153C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Identity Manager Connector versions 12.2.1.4.0 or 14.1.2.1.0 with the LDAP Gateway component. The attacker needs a logon on the infrastructure where the connector runs, so exposure is mainly from local or internal accounts. Systems without these versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91489","severity":null,"published_at":"2026-10-20T22:20:53+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91489","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91489","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}