Critical LDAP Gateway Flaw in Oracle Identity Manager Exposes Data to Unauthenticated Attackers

The National Vulnerability Database published a new record for CVE-2026-91490, identifying a critical security flaw in Oracle’s identity management infrastructure. This vulnerability exists within the LDAP Gateway component of the Oracle Identity Manager Connector product, which is part of the broader Oracle Fusion Middleware suite. The issue poses a significant risk to organizations relying on this specific connector for directory services integration.

According to the NVD record, the flaw allows an unauthenticated attacker with network access via LDAP to compromise the Oracle Identity Manager Connector. The vulnerability is rated with a CVSS 3.1 Base Score of 9.1, placing it in the critical severity range. The vector string indicates that the attack vector is network-based, attack complexity is low, and no privileges or user interaction are required to exploit the issue.

Technical Impact and Severity

Successful exploitation of CVE-2026-91490 can result in unauthorized creation, deletion, or modification of access to critical data. The NVD description specifies that an attacker could gain unauthorized access to critical data or achieve complete access to all data accessible by the Oracle Identity Manager Connector. The impact covers both confidentiality and integrity, while availability is not affected, according to the CVSS vector provided in the record.

The severity rating of 9.1 reflects the high impact on confidentiality and integrity. The NVD characterizes the vulnerability as "easily exploitable," emphasizing the low barrier to entry for potential attackers. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms that the attack requires no authentication and minimal complexity, making it a high-priority concern for security teams monitoring their LDAP interfaces.

Affected Software Versions

The vulnerability specifically affects two supported versions of the Oracle Identity Manager Connector. Organizations running version 12.2.1.4.0 are exposed to this flaw, as are those using version 14.1.2.1.0. The NVD record lists these as the supported versions that are affected, implying that other versions may not be vulnerable or are no longer supported. Security professionals should verify their current deployment versions against this list to determine if their environment is at risk.

There is no indication in the source material regarding the release date of the vulnerability or the timeline for its discovery. The NVD record serves as the primary source for this information, providing the technical details necessary for risk assessment. The focus remains on the specific component, the LDAP Gateway, which handles Lightweight Directory Access Protocol connections for the identity manager.

What should you do?

Security teams should immediately audit their Oracle Identity Manager Connector deployments to identify if they are running versions 12.2.1.4.0 or 14.1.2.1.0. If these versions are in use, organizations should assess the network exposure of the LDAP Gateway component. Restricting network access to the LDAP service can mitigate the risk of unauthenticated exploitation until a patch is available. Monitoring logs for unusual LDAP activity may also help detect potential exploitation attempts.

What to do and how to stay safe: Oracle

• Inventory all instances of Oracle Identity Manager Connector to identify if versions 12.2.1.4.0 or 14.1.2.1.0 are deployed in production environments.
• Review network firewall rules to ensure that the LDAP Gateway component is not accessible from untrusted networks or the public internet.
• Monitor LDAP traffic for anomalous patterns or unauthorized connection attempts that could indicate exploitation of CVE-2026-91490.
• Await official guidance from Oracle regarding patches or workarounds, as no fix has been confirmed in the current NVD record.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle products are affected by CVE-2026-91490?

The vulnerability affects the Oracle Identity Manager Connector product, specifically versions 12.2.1.4.0 and 14.1.2.1.0, within the Oracle Fusion Middleware suite.

What is the CVSS score for this vulnerability?

CVE-2026-91490 has a CVSS 3.1 Base Score of 9.1, which is classified as critical severity.

Can an attacker exploit this flaw without authentication?

Yes, the NVD states that an unauthenticated attacker with network access via LDAP can exploit this vulnerability to compromise the system.