Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the LDAP Gateway component of Oracle Identity Manager Connector. An unauthenticated attacker who can reach the LDAP interface can create, delete, or modify data that the connector manages, resulting in loss of confidentiality and integrity of all data accessible through the connector and potentially full access to any connected data store.

Affected Systems

Affected products are Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0, part of Oracle Fusion Middleware.

Risk and Exploitability

The CVSS base score of 9.1 indicates high severity with high confidentiality and integrity impacts. The vulnerability is exploitable by an unauthenticated attacker over the network via LDAP, without requiring authentication. EPSS indicates a very low but non-zero exploitation probability of 0.00398, and the vulnerability is not listed in the CISA KEV catalog. The potential for wide data compromise remains high.

Generated by OpenCVE AI on October 22, 2026 at 05:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Oracle Identity Manager Connector to a patched version released after the Oct‑2026 security alert.
  • Restrict LDAP gateway access to trusted hosts by configuring firewall rules or network segmentation.
  • Disable or tightly restrict LDAP operations that are not required for normal functionality, such as write or delete permissions, using connector configuration settings.

Generated by OpenCVE AI on October 22, 2026 at 05:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Interface Allows Unauthorized Data Modification in Oracle Identity Manager Connector

Wed, 21 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Gateway Access Leads to Unauthorized Data Modification in Oracle Identity Manager Connector
Weaknesses CWE-284
CWE-285

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Gateway Access Leads to Unauthorized Data Modification in Oracle Identity Manager Connector
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T11:05:30.495Z

Reserved: 2026-09-14T22:10:16.638Z

Link: CVE-2026-91490

cve-icon Vulnrichment

Updated: 2026-10-21T10:55:49.489Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:53.507

Modified: 2026-10-27T14:21:37.593

Link: CVE-2026-91490

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:45:08Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function