{"id":"CVE-2026-91490","kind":"vulnerability","aliases":["CVE-2026-91490"],"related":[],"title":"Oracle Identity Manager Connector: unauthenticated LDAP flaw exposes and alters data","description":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","summary":"Oracle Identity Manager Connector's LDAP Gateway component has a flaw that lets an unauthenticated attacker on the network reach it over LDAP. A successful attack can read, create, modify and delete data the connector can access.","severity":"critical","cvss":9.1,"epss":0.00377,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Identity Manager Connector","fixed":[],"affected":"12.2.1.4.0, 14.1.2.1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ldap","oracle","oracle-fusion-middleware","oracle-identity-manager","self-hosted","vendor"],"not_affected_if":["ldap-gateway-not-deployed","ldap-not-network-reachable","unknown"],"how_to_check":"Check whether the Oracle Identity Manager Connector is installed on 12.2.1.4.0 or 14.1.2.1.0 (list installed patches/versions with OPatch: $ORACLE_HOME/OPatch/opatch lsinventory) and whether the LDAP Gateway component is deployed and its LDAP listener reachable from untrusted networks. Compare applied patches with the Fusion Middleware patch availability document linked from the October 2026 CPU.","fix":"Apply the October 2026 Critical Patch Update for Fusion Middleware (patch availability document, on My Oracle Support, needs a support contract). Specific patch numbers not publicly readable. Until patched, restrict network access to the LDAP Gateway listener.","status":"open","published_at":"2026-10-20T22:20:53+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:57+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"vendor","confidence":0.65,"triage":{"at":"2026-10-23T22:33:57Z","model":"claude-haiku-5-5","output":{"fix":"Move to a patched Oracle Identity Manager Connector release per Oracle's Critical Patch Update advisory; affected versions per sources are 12.2.1.4.0 and 14.1.2.1.0.","reach":"network","title":"Oracle Identity Manager Connector: unauthenticated LDAP flaw exposes and alters data","impact":"high","summary":"Oracle Identity Manager Connector's LDAP Gateway component has a flaw that lets an unauthenticated attacker on the network reach it over LDAP. A successful attack can read, create, modify and delete data the connector can access.","category":"vendor","who_cares":["oracle-identity-manager","ldap","oracle-fusion-middleware"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker reads and changes all connector-accessible data","analyst_note":"Confirm whether the LDAP Gateway component is deployed and find the patched version in Oracle's CPU advisory; the sources do not give a check method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000527,"input_tokens":3154,"output_tokens":423,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the LDAP Gateway component is deployed and find the patched version in Oracle's CPU advisory; the sources do not give a check method.","search":"'-2026':13A,16A '-91490':14A,17A '/av':171C '12.2.1.4.0':94C '14.1.2.1.0':96C '3.1':159C,170C '9.1':162C 'access':72B,105C,127C,137C,143C,149C,156C 'affect':92C 'allow':100C 'alter':10A 'attack':51B,61B,102C,115C 'base':160C 'complet':148C 'compon':43B,85C 'compromis':109C 'confidenti':163C 'connector':4A,21A,39B,70B,79C,113C,136C,155C 'creat':64B 'creation':123C 'critic':129C,145C 'cve':12A,15A 'cvss':158C,167C,169C 'data':11A,68B,130C,138C,146C,157C 'delet':67B,124C 'easili':97C 'exploit':98C 'expos':8A 'flaw':7A,46B 'fusion':26B,83C 'gateway':42B,87C 'h/a':178C 'h/i':177C 'host':34B 'ident':2A,30B,37B,77C,111C,134C,153C 'identity':19A 'impact':166C 'integr':165C 'l/pr':173C 'ldap':6A,22B,41B,58B,86C,107C 'let':48B 'manag':3A,31B,38B,78C,112C,135C,154C 'manager':20A 'middlewar':27B,84C 'modif':126C 'modifi':65B 'n':179C 'n/ac':172C 'n/s':175C 'n/ui':174C 'network':54B,104C 'oracl':1A,23B,25B,29B,36B,76C,82C,110C,133C,152C 'oracle':18A 'oracle-fusion-middlewar':24B 'oracle-identity-manag':28B 'product':80C 'reach':55B 'read':63B 'result':120C 'score':161C 'self':33B 'self-host':32B 'success':60B,114C 'support':88C 'u/c':176C 'unauthent':5A,50B,101C 'unauthor':122C,142C 'vector':168C 'vendor':35B 'version':89C 'via':106C 'vulner':73C,99C,118C 'well':140C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91490","severity":null,"published_at":"2026-10-20T22:20:53+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91490:332","url":null,"severity":null,"published_at":"2026-10-23T22:56:06+00:00","modified_at":"2026-10-23T22:56:06+00:00","first_seen_at":"2026-10-23T22:56:06+00:00","fetched_at":"2026-10-23T22:56:06+00:00","note":"Oracle October 2026 CPU (cpuoct2026) lists Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 under Fusion Middleware; exact patch numbers sit behind My Oracle Support (login), so no fixed version read. No exploitation or PoC found; social search skipped as the CVE is too new and obscure. Sibling CVE-2026-91491 (Identity Manager LDAP Gateway) is a separate run."},{"source":"epss","external_id":"CVE-2026-91490","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91490","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}