---
id: "CVE-2026-91491"
kind: "vulnerability"
aliases: ["CVE-2026-91491"]
title: "Oracle Identity Manager LDAP Gateway flaw lets unauthenticated attackers take over"
severity: "critical"
cvss: 9.8
epss: 0.00331
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Identity Manager Connector", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.1.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ldap", "oracle", "oracle-fusion-middleware", "oracle-identity-manager", "other", "self-hosted"]
not_affected_if: ["no-ldap-gateway-connector", "not-network-reachable", "other-versions"]
published_at: "2026-10-20T22:20:53+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91491", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:56:10+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91491", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Identity Manager LDAP Gateway flaw lets unauthenticated attackers take over

Oracle Identity Manager Connector's LDAP Gateway component has a flaw in versions 12.2.1.4.0 and 14.1.2.1.0. A remote attacker with network access over LDAP and no login can take over the connector, per the CVSS 9.8 score.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Identity Manager Connector affected 12.2.1.4.0, 14.1.2.1.0 fixed ?

## How to check

Check whether the Oracle Identity Manager Connector (LDAP Gateway component) is installed in your Fusion Middleware home at 12.2.1.4.0 or 14.1.2.1.0, e.g. run 'opatch lsinventory' in that ORACLE_HOME and look for the connector. Then check whether the LDAP Gateway listener is reachable from untrusted networks.

## Fix

Apply the October 2026 Critical Patch Update for Fusion Middleware (patch number in the My Oracle Support patch availability document, unknown here). Until it is applied, restrict network access to the LDAP Gateway port.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91491
- 2026-10-23T22:56:10+00:00 analyst — Oracle CPU Oct 2026 lists Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0; CVE record confirms CVSS 9.8 unauth LDAP. Exact patch number is in the My Oracle Support patch doc (login needed), so unknown. No exploitation or PoC found (VulDB: no exploit; not in KEV). Did not search social posts.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91491

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91491 https://www.cve.org/CVERecord?id=CVE-2026-91491

## From the sources

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_