Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

The Oracle Identity Manager Connector’s LDAP Gateway component contains authentication bypass weaknesses (CWE-287, CWE-306) that allow an unauthenticated attacker with LDAP network access to bypass authentication. Successful exploitation permits the attacker to compromise the connector, resulting in full takeover. This can lead to loss of confidentiality, integrity, and availability for the Identity Manager service.

Affected Systems

This vulnerability affects Oracle Identity Manager Connector within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0, supplied by Oracle Corporation.

Risk and Exploitability

The flaw can be triggered over a network connection without any authentication, making it highly exploitable. The CVSS 3.1 Base Score of 9.8 reflects complete control of the system. The EPSS score of less than 1% indicates a very low probability of widespread exploitation at the time of assessment, but the existence of a critical flaw and the lack of listing in the CISA KEV catalog mean that the potential for abuse remains serious. Attacks would be launched from external or internal LDAP traffic, leveraging the LDAP Gateway to achieve remote code execution or complete control.

Generated by OpenCVE AI on October 22, 2026 at 05:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that addresses the LDAP Gateway flaw for versions 12.2.1.4.0 and 14.1.2.1.0
  • Restrict LDAP traffic to the Identity Manager Connector by limiting network access to trusted internal subnets and blocking untrusted IP addresses
  • Enable and monitor detailed logging of LDAP bind attempts to detect and respond to suspicious authentication activity

Generated by OpenCVE AI on October 22, 2026 at 05:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Gateway Remote Code Execution in Oracle Identity Manager Connector
Weaknesses CWE-284

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Gateway Remote Code Execution in Oracle Identity Manager Connector
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T10:55:17.283Z

Reserved: 2026-09-14T22:10:16.638Z

Link: CVE-2026-91491

cve-icon Vulnrichment

Updated: 2026-10-21T10:53:37.210Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:53.617

Modified: 2026-10-27T14:22:27.873

Link: CVE-2026-91491

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:45:08Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function