Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation and Unauthorized Data Modification
Action: Immediate Patch
AI Analysis

Impact

A local vulnerability exists in the LDAP Gateway of Oracle Identity Manager Connector. The flaw enables an attacker who has low‑privileged access to the host where the component runs to override proper access controls and create, delete, or alter data managed by the Connector. Successful exploitation results in confidentiality and integrity compromise of all data accessible through the Connector while availability remains unaffected.

Affected Systems

Affected products are Oracle Identity Manager Connector from Oracle Corporation. According to the CNA, the vulnerable versions are 12.2.1.4.0 and 14.1.2.1.0. The description does not state whether other releases are affected, so no definitive assertion can be made about additional versions.

Risk and Exploitability

The CVSS v3.1 base score of 7.1 indicates a moderate to high severity. Attackers require local access and low privilege, with no user interaction needed. The EPSS score of 0.00104 indicates a very low exploitation probability, and the issue is not listed in the CISA KEV catalog, yet the ability to modify critical data makes this a significant risk for systems that rely on the Connector.

Generated by OpenCVE AI on October 27, 2026 at 23:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patch or update for Oracle Identity Manager Connector provided by Oracle to address the LDAP Gateway vulnerability.
  • Restrict local logon capabilities to users with minimal privileges required to perform necessary operations on the host.
  • Enforce network segmentation to limit communication with the Identity Manager Connector only to trusted, validated systems, thereby reducing the attack surface available to local attackers.

Generated by OpenCVE AI on October 27, 2026 at 23:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation and Data Manipulation in Oracle Identity Manager Connector LDAP Gateway

Tue, 27 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation and Data Manipulation in Oracle Identity Manager Connector LDAP Gateway
Weaknesses CWE-640

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Sat, 24 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-640

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:30:41.969Z

Reserved: 2026-09-14T22:10:16.638Z

Link: CVE-2026-91489

cve-icon Vulnrichment

Updated: 2026-10-24T03:30:36.791Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:53.390

Modified: 2026-10-27T14:21:19.763

Link: CVE-2026-91489

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T23:15:07Z

Weaknesses