An unauthenticated attacker with network access over LDAP can take over Oracle Identity Manager Connector through this flaw in its LDAP Gateway component, which carries a CVSS 3.1 score of 9.8.
What Is It
CVE-2026-91491 is a vulnerability in the LDAP Gateway component of Oracle Identity Manager Connector, part of Oracle Fusion Middleware. Oracle describes it as "easily exploitable." An unauthenticated attacker who can reach the product over LDAP can compromise it. A successful attack can lead to full takeover of Oracle Identity Manager Connector.
Oracle ([email protected]) assigned the CVE. It was published to NVD on 2026-10-20, and its NVD status is currently "Received."
Why It Matters
Oracle scores this flaw at 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- Network-reachable: it can be attacked remotely over LDAP.
- Low complexity: no special conditions are needed to exploit it.
- No privileges or user interaction: the attacker needs no credentials, and no user has to do anything.
- High impact on confidentiality, integrity and availability: a successful attack fully compromises the component.
Identity Manager connectors link identity governance to downstream systems, so a takeover here is serious. The supplied data does not describe any further impact beyond the connector itself.
Exploitation status: No CISA KEV entry was provided for this CVE, so KEV does not confirm active exploitation at this time. The supplied sources do not mention any public proof-of-concept or observed attacks.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Identity Manager Connector (Oracle Fusion Middleware)
- Component: LDAP Gateway
- Affected supported versions:
- 12.2.1.4.0
- 14.1.2.1.0
NVD does not yet list any specific CPEs for this record.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update (CPU) advisory as its vendor reference. Organizations running the affected versions should check that advisory for fix availability and apply the patches it provides.
Since there is no KEV entry, CISA has not issued a required action or due date for this CVE. Given the critical score and the lack of an authentication requirement, it should still be patched as a priority. Until it is patched, limit network access to the LDAP Gateway to trusted hosts only.