External risk intelligence

Oracle Identity Manager Connector LDAP Gateway Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-91490

The vulnerability affects the LDAP Gateway component of the Oracle Identity Manager Connector. While LDAP is a network-accessible protocol, such gateways are typically deployed within internal network segments to manage directory services rather than being exposed directly to the public internet. Internet-facing exposure is possible in specific configurations but is not a standard deployment pattern.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Identity Manager Connector, which is part of Oracle Fusion Middleware. This issue, exploitable remotely without authentication, could allow an attacker to gain unauthorized access to or modify critical data within the affected systems. The primary concern is to confirm if our organization utilizes this specific Oracle product and assess potential exposure.

Unauthenticated attackers can access or alter critical data.
Important to know if Oracle Identity Manager Connector is used.
Confirm relevance and assess potential impact.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could leverage the LDAP Gateway component within Oracle Identity Manager Connector to gain unauthorized access. By sending specially crafted network requests over LDAP, an attacker could compromise the system, leading to the unauthorized creation, deletion, or modification of critical data.

Network access required.
Exploits the LDAP Gateway component.
Leads to data compromise.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise the Oracle Identity Manager Connector, potentially leading to unauthorized modification, deletion, or access of critical data. This could affect the integrity and confidentiality of data managed by the connector when network access is possible.

Critical data integrity and confidentiality.
Unauthorized network access to the connector.
Data modification or complete access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Oracle Identity Manager Connector, specifically its LDAP Gateway component. Responsibility likely falls to the platform or infrastructure teams managing Oracle Fusion Middleware, in coordination with application owners and security teams to assess exposure and prioritize remediation. The first practical step involves identifying all instances of the affected technology, determining their accessibility and criticality, and confirming the accountable owner before planning any necessary actions.

Platform and application teams own remediation.
Verify instance reachability and criticality.
Coordinate vendor support and plan maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Identity Manager Connector?

It is a component within Oracle Fusion Middleware designed to bridge Oracle Identity Manager with external systems. It enables centralized identity lifecycle management, such as provisioning and synchronization of user accounts across different platforms. The LDAP Gateway specifically handles communication with directory services to ensure identity data remains consistent across the infrastructure.

What does CVE-2026-91490 mean for system security?

This vulnerability represents a significant flaw in how the LDAP Gateway processes network requests. It is a logic or access control weakness that allows unauthorized individuals to bypass authentication requirements. Successfully triggering this vulnerability grants an attacker the ability to view, modify, or delete sensitive data managed by the connector without needing valid credentials.

How is this vulnerability triggered?

An attacker triggers this by sending specially crafted, unauthorized requests over the network directly to the LDAP Gateway component. The bug does not require any prior authentication or user interaction to succeed. It will not be triggered by internal system processes or authenticated administrative tasks that operate within the software's intended security constraints.

Is my organization at risk from this vulnerability?

According to Halo Surface Signal, this vulnerability is most relevant if the LDAP Gateway is reachable over a network. While these gateways are typically placed in internal segments to manage directory services and are not standard public-facing assets, any configuration that exposes the service to a broader network—especially the internet—significantly increases the potential for unauthorized access.

What should I do if we use this software?

First, verify if your environment runs version 12.2.1.4.0 or 14.1.2.1.0 of the Oracle Identity Manager Connector. Work with your platform and infrastructure teams to map where the LDAP Gateway is deployed and confirm its current network accessibility. Once the footprint is identified, coordinate with your security team to review official Oracle security updates and plan the necessary maintenance.

References

www.oracle.com/security-alerts/cpuoct2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.