Oracle Identity Manager Connector CVE-2026-91490: Critical LDAP Gateway Vuln Allows Full Data Manipulation

The National Vulnerability Database lists a high-severity vulnerability in the Oracle Identity Manager Connector that exposes internal data to unauthenticated attackers. The flaw resides in the LDAP Gateway component and affects specific versions of the Oracle Fusion Middleware suite.

What happened

The National Vulnerability Database lists CVE-2026-91490 as a critical issue within the Oracle Identity Manager Connector product. This vulnerability exists in the LDAP Gateway component of the Oracle Fusion Middleware ecosystem. According to the advisory, supported versions 12.2.1.4.0 and 14.1.2.1.0 are directly affected by this security gap. The flaw is described as easily exploitable by an attacker who has network access to the targeted LDAP service. No user interaction or authentication credentials are required to initiate the exploit against these systems.

An attacker leveraging this vulnerability can compromise the integrity and confidentiality of the connector. Successful exploitation results in unauthorized access to critical data handled by the Oracle Identity Manager Connector. Furthermore, the threat actor can create, delete, or modify any data accessible to the component. The CVSS vector indicates that the attack is network-based and requires low complexity. There are no privileges required, and user interaction is not needed for the attack to succeed.

Why it matters

The CVSS 3.1 base score of 9.1 reflects the severe impact on both confidentiality and integrity. With no authentication required, any entity with network reach to the LDAP Gateway can potentially interact with the connector. This broadens the attack surface significantly for organizations running the affected versions of the Oracle Fusion Middleware. The ability to modify or delete data introduces a direct risk to the reliability of identity management processes. Organizations must verify which versions of the connector are deployed in their environments. Failure to identify these specific version strings leaves systems open to unauthenticated manipulation.

What to watch

• Monitor LDAP traffic for unexpected bind attempts from unknown IP addresses.
• Watch for sudden changes in user attributes or group memberships without corresponding administrative actions.
• Alert on high volumes of LDAP query traffic that may indicate enumeration or data exfiltration.
• Check for failed authentication attempts followed by successful data modification operations.

Signals worth monitoring

Security teams usually review LDAP server logs for anomalous bind requests that lack valid credentials. Check whether the LDAP Gateway is receiving traffic from unexpected network segments or public interfaces. Look for patterns where data modifications occur without preceding administrative sessions. Monitor for spikes in query volume that could signal an attacker enumerating directory objects. Verify that access controls on the connector are functioning as expected during routine audits. Ensure that alerting thresholds for data changes are set to catch unauthorized modifications quickly.

What to do and how to stay safe: Oracle

• Inventory all instances of Oracle Identity Manager Connector to identify deployments of versions 12.2.1.4.0 and 14.1.2.1.0.
• Restrict network access to the LDAP Gateway component to only trusted and necessary internal hosts.
• Enable detailed logging on LDAP services to capture all bind attempts and data modification requests.
• Prepare an incident response plan for potential unauthorized data access or modification once the vendor provides an update.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of Oracle Identity Manager Connector are affected by CVE-2026-91490?

The vulnerability affects supported versions 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Identity Manager Connector product.

What is the CVSS score for this vulnerability?

The CVSS 3.1 Base Score for CVE-2026-91490 is 9.1, which is classified as critical.

Does exploiting this flaw require authentication?

No, the vulnerability allows an unauthenticated attacker with network access to exploit the system via the LDAP Gateway.