---
id: "CVE-2026-91493"
kind: "vulnerability"
aliases: ["CVE-2026-91493"]
title: "Oracle Identity Manager Connector: LDAP Gateway flaw exposes data to unauthenticated attackers"
severity: "high"
cvss: 7.5
epss: 0.00287
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["identity-management", "ldap", "oracle-fusion-middleware", "oracle-identity-manager", "vendor"]
not_affected_if: ["other-versions"]
published_at: "2026-10-20T22:20:53+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91493", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91493", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Identity Manager Connector: LDAP Gateway flaw exposes data to unauthenticated attackers

Oracle Identity Manager Connector's LDAP Gateway component has a flaw that lets an unauthenticated attacker reach it over the network via LDAP. A successful attack gives access to critical data held by the connector, with a CVSS 3.1 score of 7.5 that is confidentiality-only.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify whether Oracle Identity Manager Connector is deployed and which version runs, for example `12.2.1.4.0` or `14.1.2.1.0`
- Check whether the LDAP Gateway component is enabled and reachable from the network
- unknown for other checks, the sources do not give specific commands or paths

## Fix

- Apply the Oracle Critical Patch Update for Oracle Fusion Middleware that covers Oracle Identity Manager Connector (affected versions `12.2.1.4.0` and `14.1.2.1.0`)
- unknown for the exact patched version, the sources do not say

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91493
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91493

## From the sources

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_