---
id: "CVE-2026-91489"
kind: "vulnerability"
aliases: ["CVE-2026-91489"]
title: "Oracle Identity Manager Connector: LDAP Gateway flaw lets local users read and change data"
severity: "high"
cvss: 7.1
epss: 0.00104
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["identity-management", "ldap", "oracle-fusion-middleware", "oracle-identity-manager", "other"]
not_affected_if: ["no-ldap-gateway", "other-versions"]
published_at: "2026-10-20T22:20:53+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91489", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91489", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Identity Manager Connector: LDAP Gateway flaw lets local users read and change data

An LDAP Gateway component of the Oracle Identity Manager Connector in Oracle Fusion Middleware has a flaw that lets a low-privileged user on the host compromise the connector. A successful attack allows unauthorized creation, modification, deletion and reading of data the connector can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify whether Oracle Identity Manager Connector is installed and check its version against `12.2.1.4.0` and `14.1.2.1.0`
- Confirm whether the LDAP Gateway component is deployed on the host

## Fix

- Apply the Oracle Critical Patch Update for Oracle Identity Manager Connector (fixed release not named in the sources; unknown)

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91489
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91489

## From the sources

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_