Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and disclosure
Action: Patch Immediately
AI Analysis

Impact

The Oracle Identity Manager Connector contains a weakness in LDAP Gateway component that permits an unauthenticated attacker with network access to compromise the service. The flaw is an access-control issue (CWE‑284) that allows the attacker to create, delete, or modify critical data and to read all data accessible through the Connector. This leads to both confidentiality and integrity compromise, as indicated by the CVSS 3.1 base score of 7.4.

Affected Systems

Affected versions are Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, which are part of Oracle Fusion Middleware. The issue is specific to the LDAP Gateway component of these releases.

Risk and Exploitability

Exploitation requires only network connectivity to the Connector’s LDAP Gateway port and does not need authentication, making the attack surface wide. Although described as difficult to exploit and the EPSS score is below 1%, the high CVSS score and potential for extensive data manipulation create a serious risk. The vulnerability is not listed in CISA’s KEV catalog, but the impact warrants immediate attention.

Generated by OpenCVE AI on October 28, 2026 at 01:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the Oracle Identity Manager Connector update released in Oracle CPU Oct 2026 to patch the LDAP Gateway flaw.
  • Configure network segmentation to limit inbound TCP traffic to the Connector’s LDAP Gateway port, allowing only trusted IP ranges or applying firewall rules.
  • If the patch cannot be applied immediately, isolate the Connector from public networks or place it behind a VPN to contain potential exposure.

Generated by OpenCVE AI on October 28, 2026 at 01:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Gateway Access Control Failure in Oracle Identity Manager Connector

Tue, 27 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Gateway Control Enables Data Tampering in Oracle Identity Manager Connector
Weaknesses CWE-287

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Sat, 24 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Gateway Control Enables Data Tampering in Oracle Identity Manager Connector
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:33:41.186Z

Reserved: 2026-09-14T22:10:16.638Z

Link: CVE-2026-91494

cve-icon Vulnrichment

Updated: 2026-10-24T03:33:35.509Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:53.987

Modified: 2026-10-27T14:22:55.973

Link: CVE-2026-91494

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:45:12Z

Weaknesses