CVE-2026-91490 in Identity Manager Connector
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the LDAP Gateway component of Oracle Identity Manager Connector, a critical subsystem in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. This security flaw stems from insufficient validation or access control mechanisms inherent to how the connector processes Lightweight Directory Access Protocol requests. The architecture allows an unauthenticated actor with network connectivity to interact directly with this gateway, bypassing standard authentication protocols that should restrict such interactions. Because the LDAP Gateway serves as a bridge between directory services and identity management operations, compromising it effectively grants the attacker direct influence over the underlying data structures managed by Oracle Identity Manager.
The technical nature of this flaw aligns closely with CWE-287, which describes Improper Authentication, and potentially CWE-915, regarding Improper Control of Dynamically-Identified Variables if the exploitation involves manipulating dynamic query parameters or object identifiers within LDAP requests. The vulnerability is classified as easily exploitable due to its low complexity requirements; no user interaction or prior credentials are necessary for an attacker to initiate a successful attack sequence from across the network. This characteristic places it firmly within the Network Attack Vector category of the Common Vulnerability Scoring System, indicating that remote adversaries can leverage this weakness without physical access or local system privileges on the target host.
Successful exploitation results in severe consequences for both data confidentiality and integrity, as reflected by a CVSS 3.1 Base Score of 9.1. An attacker who exploits this vulnerability gains unauthorized capabilities to create, delete, or modify critical identity records stored within the Oracle Identity Manager database. This includes sensitive user profiles, group memberships, role assignments, and access policies. The impact extends beyond mere data alteration; it allows for complete unauthorized access to all data accessible by the connector service account. In practical terms, this means an adversary could escalate privileges, impersonate legitimate users, or disrupt organizational identity workflows by injecting malicious entries into the directory structure.
From a tactical perspective, this vulnerability maps directly to MITRE ATT&CK technique T1078, Valid Accounts, specifically when used in conjunction with initial access techniques that do not require credential theft because none are needed initially. Furthermore, the ability to modify critical data aligns with T1496, Resource Hijacking or Data Manipulation tactics depending on the specific payload executed after gaining write access. The lack of authentication requirement makes this particularly dangerous for automated scanning tools and opportunistic attackers who can probe networks indiscriminately for vulnerable instances without needing sophisticated social engineering or initial foothold strategies.
Mitigation requires immediate attention to patch management processes within environments running affected versions of Oracle Fusion Middleware. Organizations must apply the latest security patches provided by Oracle that address the LDAP Gateway authentication bypass. Until patches are applied, network segmentation should be enforced to restrict access to the LDAP ports used by the Identity Manager Connector exclusively from trusted application servers and administrative workstations. Additionally, implementing strict firewall rules to block external or untrusted internal IP addresses from reaching these services can significantly reduce the attack surface. Monitoring logs for anomalous LDAP query patterns, particularly those involving high-volume modifications or unusual object class manipulations, may also help in detecting attempted exploitation activities before they result in significant data compromise.