Oracle Identity Manager Connector Has Critical Unauthenticated LDAP Flaw

Oracle Identity Manager Connector contains a critical vulnerability that allows unauthenticated attackers to take over the system. The flaw, tracked as CVE-2026-91491, exists in the LDAP Gateway component of Oracle Fusion Middleware. According to the National Vulnerability Database record, the issue is easily exploitable over a network connection using the Lightweight Directory Access Protocol.

The vulnerability carries a CVSS 3.1 Base Score of 9.8, which is classified as critical. The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates that the attack vector is network-based. The complexity of the attack is low, and no privileges or user interaction are required. Successful exploitation results in high impacts on confidentiality, integrity, and availability of the affected system.

Technical details and scope

The National Vulnerability Database describes the weakness as allowing an attacker with network access via LDAP to compromise the Oracle Identity Manager Connector. The description notes that the vulnerability is easily exploitable, meaning that no specialized conditions are needed to attempt an attack. The attacker does not need to authenticate to the target system before launching the exploit.

The impact of a successful attack is takeover of the Oracle Identity Manager Connector. This means the attacker gains control over the component. The high scores for confidentiality, integrity, and availability reflect the significant impact on the system's security posture. The source material states that successful attacks can result in takeover of the connector.

Affected versions and products

Only specific versions of the Oracle Identity Manager Connector are affected by this vulnerability. The National Vulnerability Database lists version 12.2.1.4.0 as a supported version that is affected. Version 14.1.2.1.0 is also listed as a supported version that is affected by this flaw.

Organizations using other versions of the product are not listed in the current record as being affected. Administrators should verify their exact version numbers against the list provided by Oracle. The vulnerability is specific to the LDAP Gateway component within the connector. The source material identifies the component as LDAP Gateway within Oracle Fusion Middleware.

What should you do?

Administrators should immediately check if they are running the affected versions of Oracle Identity Manager Connector. If the system is exposed to the network via LDAP, the risk is immediate. Organizations should review their firewall rules to restrict access to the LDAP ports. Limiting access to trusted networks can reduce the attack surface until a fix is available.

What to do and how to stay safe: Oracle

• Verify the version of Oracle Identity Manager Connector installed in your environment to see if it matches 12.2.1.4.0 or 14.1.2.1.0.
• Restrict network access to the LDAP Gateway component to only trusted hosts and internal networks to reduce exposure.
• Monitor logs for unusual LDAP activity or failed authentication attempts that could indicate an exploitation attempt.
• Contact Oracle support to inquire about patches or temporary workarounds for CVE-2026-91491, as no fix has been confirmed yet.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-91491?

CVE-2026-91491 is a critical vulnerability in the Oracle Identity Manager Connector that allows unauthenticated attackers to take over the system via LDAP.

Which versions are affected?

Versions 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Identity Manager Connector are affected by this vulnerability.

Is there a patch available?

No fix has been confirmed yet; administrators should monitor Oracle for updates or contact support for guidance.