---
id: "CVE-2026-91490"
kind: "vulnerability"
aliases: ["CVE-2026-91490"]
title: "Oracle Identity Manager Connector: unauthenticated LDAP flaw exposes and alters data"
severity: "critical"
cvss: 9.1
epss: 0.00377
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Identity Manager Connector", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.1.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ldap", "oracle", "oracle-fusion-middleware", "oracle-identity-manager", "self-hosted", "vendor"]
not_affected_if: ["ldap-gateway-not-deployed", "ldap-not-network-reachable", "unknown"]
published_at: "2026-10-20T22:20:53+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91490", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:56:06+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91490", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Identity Manager Connector: unauthenticated LDAP flaw exposes and alters data

Oracle Identity Manager Connector's LDAP Gateway component has a flaw that lets an unauthenticated attacker on the network reach it over LDAP. A successful attack can read, create, modify and delete data the connector can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Identity Manager Connector affected 12.2.1.4.0, 14.1.2.1.0 fixed ?

## How to check

Check whether the Oracle Identity Manager Connector is installed on 12.2.1.4.0 or 14.1.2.1.0 (list installed patches/versions with OPatch: $ORACLE_HOME/OPatch/opatch lsinventory) and whether the LDAP Gateway component is deployed and its LDAP listener reachable from untrusted networks. Compare applied patches with the Fusion Middleware patch availability document linked from the October 2026 CPU.

## Fix

Apply the October 2026 Critical Patch Update for Fusion Middleware (patch availability document, on My Oracle Support, needs a support contract). Specific patch numbers not publicly readable. Until patched, restrict network access to the LDAP Gateway listener.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91490
- 2026-10-23T22:56:06+00:00 analyst — Oracle October 2026 CPU (cpuoct2026) lists Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 under Fusion Middleware; exact patch numbers sit behind My Oracle Support (login), so no fixed version read. No exploitation or PoC found; social search skipped as the CVE is too new and obscure. Sibling CVE-2026-91491 (Identity Manager LDAP Gateway) is a separate run.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91490

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html

## From the sources

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_