Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized LDAP data disclosure
Action: Assess
AI Analysis

Impact

The flaw manifests as an access‑control and authentication‑bypass weakness (CWE‑287) that allows a caller to bind to the Oracle Identity Manager Connector service without supplying credentials. By exploiting this vulnerability, an attacker can retrieve any LDAP entries that the connector exposes, effectively compromising confidentiality of critical data from the connector. The vulnerability does not require privileged or elevated access and is limited to the LDAP interface.

Affected Systems

Oracle Identity Manager Connector, part of Oracle Fusion Middleware, is affected. The vulnerability applies to versions 12.2.1.4.0 and 14.1.2.1.0 of the product.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 indicates a high confidentiality impact. Attack complexity is low and only network connectivity to the LDAP port is required, implying that an unauthenticated attacker anywhere able to reach the target can exploit the flaw. The EPSS score is less than 1 %, suggesting a low probability of widespread exploitation at the time of this assessment, and the vulnerability has not been catalogued in the CISA KEV list.

Generated by OpenCVE AI on October 28, 2026 at 00:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor‑provided patch or upgrade the Oracle Identity Manager Connector to a version that contains the fix as soon as it becomes available.
  • Configure firewalls or security groups so that only trusted hosts or networks can reach the LDAP port of the connector.
  • Enable logging of LDAP bind operations and set up alerting for unexpected successful binds coming from unknown sources.
  • Consult Oracle’s support or advisories for guidance on additional controls until a fixed version is released.

Generated by OpenCVE AI on October 28, 2026 at 00:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Unauthorized LDAP Access in Oracle Identity Manager Connector

Tue, 27 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Access Allows Confidentiality Breach in Oracle Identity Manager Connector
Weaknesses CWE-284

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Sat, 24 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Access Allows Confidentiality Breach in Oracle Identity Manager Connector
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:32:49.641Z

Reserved: 2026-09-14T22:10:16.638Z

Link: CVE-2026-91493

cve-icon Vulnrichment

Updated: 2026-10-24T03:32:43.107Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:53.870

Modified: 2026-10-27T14:22:50.767

Link: CVE-2026-91493

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T00:15:08Z

Weaknesses