Oracle Identity Manager LDAP Gateway Allows Unauthenticated Takeover

Oracle Identity Manager Connector contains a severe vulnerability that permits remote attackers to seize control of the system without providing any credentials. The flaw resides within the LDAP Gateway component of Oracle Fusion Middleware. National Vulnerability Database records classify the issue as critical due to its ease of exploitation and the total loss of system integrity it enables.

The risk

The vulnerability, tracked as CVE-2026-91491, carries a CVSS score of 9.8. This rating reflects high impacts on confidentiality, integrity, and availability. An attacker with network access to the LDAP service can exploit the flaw with low complexity. No user interaction is required for the attack to succeed. The vector allows for remote compromise directly over the network.

Who is exposed

Two specific versions of the Oracle Identity Manager Connector are affected. Version 12.2.1.4.0 is vulnerable to this unauthenticated takeover attempt. Version 14.1.2.1.0 is also affected by the same flaw in the LDAP Gateway. Organizations running these specific builds of Oracle Fusion Middleware face direct exposure if the LDAP service is accessible from untrusted networks.

Cost and compliance

The source material does not provide details regarding financial costs or specific compliance implications. The National Vulnerability Database record focuses strictly on the technical severity and affected versions. No regulatory fines or breach costs are mentioned in the available data. Compliance teams should assess exposure based on the critical nature of the identity management component.

What to watch

Security managers should verify if their environments run the affected Oracle Identity Manager Connector versions. Immediate attention is required if the LDAP Gateway is exposed to external networks. Teams must determine if any unauthenticated LDAP traffic is reaching these systems. Prompt isolation of vulnerable components is necessary until a resolution is available.

Signals worth monitoring

Teams usually observe unusual LDAP bind attempts from unfamiliar IP addresses during such incidents. Check whether identity logs show successful authentication events without preceding credential validation steps. Look for sudden spikes in directory queries originating from the LDAP Gateway component. Verify if administrative actions occur outside of normal maintenance windows. Isolate affected network segments to prevent lateral movement while investigating the source. Review firewall logs for connections to the LDAP port from untrusted zones. Ensure monitoring tools capture full packet details for anomalous LDAP traffic patterns.

What to do and how to stay safe: Oracle

• Audit inventory to confirm if Oracle Identity Manager Connector versions 12.2.1.4.0 or 14.1.2.1.0 are deployed.
• Restrict network access to the LDAP Gateway component to trusted internal IPs only.
• Monitor LDAP service logs for unauthenticated bind attempts or unusual query volumes.
• Prepare to isolate the connector from the network once the vendor provides an update.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle products are affected by CVE-2026-91491?

Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 are affected.

Can an attacker exploit this flaw without credentials?

Yes, the vulnerability allows unauthenticated attackers to exploit it via network access.

What is the severity rating of this vulnerability?

The CVSS 3.1 Base Score is 9.8, which is rated as Critical.