CVE-2026-91490 is a critical (CVSS 9.1) vulnerability in the LDAP Gateway component of Oracle Identity Manager Connector that lets an unauthenticated attacker with network access read, create, modify, or delete critical data.
What Is It
CVE-2026-91490 affects the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically its LDAP Gateway component. Oracle describes it as an "easily exploitable" vulnerability. An unauthenticated attacker with network access over LDAP can use it to compromise Oracle Identity Manager Connector.
Oracle ([email protected]) assigned it a CVSS 3.1 base score of 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Confidentiality / Integrity Impact: High
- Availability Impact: None
NVD published the record on 2026-10-20. Its status is currently "Received."
Why It Matters
The attacker needs no credentials and no user interaction, and the attack complexity is low. A successful attack can give the attacker unauthorized creation, deletion, or modification access to critical data or all data the connector can reach. It can also give unauthorized access to critical data or complete access to all data the connector can reach.
Identity Manager connectors sit between identity governance and connected directory systems. Losing confidentiality and integrity on the connector's data is therefore a serious risk for organizations that run it.
This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied source material does not confirm active exploitation.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Identity Manager Connector (Oracle Fusion Middleware)
- Component: LDAP Gateway
- Affected supported versions:
- 12.2.1.4.0
- 14.1.2.1.0
The NVD record lists no CPE entries yet.
Patch Status
NVD's only reference for this CVE is Oracle's October 2026 Critical Patch Update advisory. Administrators running the affected versions should check that advisory for the fix and apply it.
Because no CISA KEV entry exists, there is no federal required action or due date. Still, the flaw needs no authentication and is reachable over the network, so patching it should be a priority. Organizations should also confirm which systems can reach the LDAP Gateway over the network.