Key points
- The flaw affects Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0.
- Attackers require only network access via LDAP to exploit the issue without authentication.
- Successful exploitation grants full read, write, or delete access to all accessible data.
Unauthenticated attackers with network access can now compromise the Oracle Identity Manager Connector. By targeting the LDAP Gateway component, they gain complete control over accessible data. This includes the ability to create, delete, or modify critical information without any credentials. The vulnerability is rated as critical by the National Vulnerability Database.
In plain English
The Oracle Identity Manager Connector acts as a bridge between identity systems and other services. The LDAP Gateway within this product is designed to handle directory queries securely. However, a flaw in this component allows outsiders to bypass authentication entirely. Instead of verifying who is asking for data, the system processes requests from anyone on the network.
The background
This issue specifically impacts two supported versions of the software: 12.2.1.4.0 and 14.1.2.1.0. The National Vulnerability Database assigned the identifier CVE-2026-91490 to this vulnerability. It carries a CVSS score of 9.1, indicating severe risk. The vector shows that no user interaction is required, making remote exploitation straightforward for any adversary with network reach.
What changes now
Organisations using these specific versions must treat this as an urgent risk. The flaw allows for both confidentiality and integrity impacts, meaning data can be stolen or altered. There is no confirmed patch or fix mentioned in the current records. Until a vendor update is available, exposure remains high for any instance connected to the network via LDAP.
The attacker's path
Teams usually monitor for unauthorised LDAP traffic originating from external sources. Check whether your network architecture exposes identity connectors directly to the internet. This type of weakness typically serves the initial access stage of an intrusion. Attackers look for services that accept requests without verifying identity. Focus on isolating these components and restricting LDAP ports to trusted internal networks only.
What to do and how to stay safe: Oracle Identity Manager
- Verify if your environment runs Oracle Identity Manager Connector versions 12.2.1.4.0 or 14.1.2.1.0.
- Restrict network access to the LDAP Gateway component to trusted internal subnets only.
- Monitor LDAP traffic logs for unusual query volumes or requests from unknown IP addresses.
- Prepare to apply a vendor update immediately once one is officially released.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Oracle products are affected by CVE-2026-91490?
The Oracle Identity Manager Connector product of Oracle Fusion Middleware is affected.
What versions of the software are vulnerable?
Supported versions 12.2.1.4.0 and 14.1.2.1.0 are affected by this vulnerability.
Can an attacker exploit this without logging in?
Yes, the vulnerability allows an unauthenticated attacker with network access via LDAP to compromise the system.
