{"id":"CVE-2026-91491","kind":"vulnerability","aliases":["CVE-2026-91491"],"related":[],"title":"Oracle Identity Manager LDAP Gateway flaw lets unauthenticated attackers take over","description":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Identity Manager Connector's LDAP Gateway component has a flaw in versions 12.2.1.4.0 and 14.1.2.1.0. A remote attacker with network access over LDAP and no login can take over the connector, per the CVSS 9.8 score.","severity":"critical","cvss":9.8,"epss":0.00331,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Identity Manager Connector","fixed":[],"affected":"12.2.1.4.0, 14.1.2.1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ldap","oracle","oracle-fusion-middleware","oracle-identity-manager","other","self-hosted"],"not_affected_if":["no-ldap-gateway-connector","not-network-reachable","other-versions"],"how_to_check":"Check whether the Oracle Identity Manager Connector (LDAP Gateway component) is installed in your Fusion Middleware home at 12.2.1.4.0 or 14.1.2.1.0, e.g. run 'opatch lsinventory' in that ORACLE_HOME and look for the connector. Then check whether the LDAP Gateway listener is reachable from untrusted networks.","fix":"Apply the October 2026 Critical Patch Update for Fusion Middleware (patch number in the My Oracle Support patch availability document, unknown here). Until it is applied, restrict network access to the LDAP Gateway port.","status":"open","published_at":"2026-10-20T22:20:53+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:55+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T22:33:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Identity Manager LDAP Gateway flaw lets unauthenticated attackers take over","impact":"high","summary":"Oracle Identity Manager Connector's LDAP Gateway component has a flaw in versions 12.2.1.4.0 and 14.1.2.1.0. A remote attacker with network access over LDAP and no login can take over the connector, per the CVSS 9.8 score.","category":"other","who_cares":["oracle-identity-manager","ldap","oracle-fusion-middleware"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over the connector with full confidentiality, integrity and availability impact","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch version and the LDAP Gateway exposure check; the sources give no fix or detection steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000499,"input_tokens":3097,"output_tokens":378,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch version and the LDAP Gateway exposure check; the sources give no fix or detection steps.","search":"'-2026':12A,15A '-91491':13A,16A '/av':141C '12.2.1.4.0':48B,93C '14.1.2.1.0':50B,95C '3.1':128C,140C '9.8':70B,131C 'access':56B,104C 'affect':91C 'allow':99C 'attack':9A,53B,101C,114C 'avail':135C 'base':129C 'compon':42B,84C 'compromis':108C 'confidenti':132C 'connector':20A,38B,66B,78C,112C,126C 'cve':11A,14A 'cvss':69B,127C,137C,139C 'easili':96C 'exploit':97C 'flaw':6A,45B 'fusion':25B,82C 'gateway':5A,41B,86C 'h':149C 'h/a':148C 'h/i':147C 'host':34B 'ident':2A,29B,36B,76C,110C,124C 'identity':18A 'impact':136C 'integr':133C 'l/pr':143C 'ldap':4A,21B,40B,58B,85C,106C 'let':7A 'login':61B 'manag':3A,30B,37B,77C,111C,125C 'manager':19A 'middlewar':26B,83C 'n/ac':142C 'n/s':145C 'n/ui':144C 'network':55B,103C 'oracl':1A,22B,24B,28B,35B,75C,81C,109C,123C 'oracle':17A 'oracle-fusion-middlewar':23B 'oracle-identity-manag':27B 'per':67B 'product':79C 'remot':52B 'result':119C 'score':71B,130C 'self':33B 'self-host':32B 'success':113C 'support':87C 'take':10A,63B 'takeov':121C 'u/c':146C 'unauthent':8A,100C 'vector':138C 'version':47B,88C 'via':105C 'vulner':72C,98C,117C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91491","severity":null,"published_at":"2026-10-20T22:20:53+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91491:331","url":null,"severity":null,"published_at":"2026-10-23T22:56:10+00:00","modified_at":"2026-10-23T22:56:10+00:00","first_seen_at":"2026-10-23T22:56:10+00:00","fetched_at":"2026-10-23T22:56:10+00:00","note":"Oracle CPU Oct 2026 lists Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0; CVE record confirms CVSS 9.8 unauth LDAP. Exact patch number is in the My Oracle Support patch doc (login needed), so unknown. No exploitation or PoC found (VulDB: no exploit; not in KEV). Did not search social posts."},{"source":"epss","external_id":"CVE-2026-91491","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91491","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1685,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91491","title":"CVE Record: CVE-2026-91491","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}