Identity Manager Connector CVE-2026-91490

Exploitation requires network access to the Oracle Identity Manager Connector's LDAP Gateway component (the exposed LDAP listener); the vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0 specifically. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required - exploitation is 'easily exploitable' by an unauthenticated attacker able to reach the LDAP service. The primary limiting factor is network exposure of the LDAP Gateway: environments that restrict the gateway to trusted internal/management segments or behind network controls substantially reduce reachability and therefore real-world risk.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile: network-reachable, low attack complexity, no privileges, and no user interaction - meaning a remote unauthenticated attacker can exploit it directly. The 9.1 base score is driven by High confidentiality and High integrity impact (C:H/I:H); availability is unaffected (A:N), so this is a data-compromise and data-tampering flaw rather than a denial-of-service one. Several corroborating exploitation signals are MISSING from the provided data: there is no EPSS score, no CISA KEV listing, and no POC indicator, so real-world exploitation probability cannot be quantified from the input - exploitation status is therefore 'no public exploit identified at time of analysis.' The only reference is the Oracle Critical Patch Update advisory (cpuoct2026.html), consistent with a vendor-coordinated disclosure rather than active in-the-wild exploitation. One point to verify: the 'Authentication Bypass' tag plus PR:N and the LDAP Gateway component strongly imply the vulnerability lets an attacker bypass authentication to the identity-management layer, which is especially severe because OIM is itself a security-control system; compromise here can cascade into unauthorized account creation/modification across connected systems.

A remote, unauthenticated attacker with network reachability to the Oracle Identity Manager Connector's LDAP Gateway sends crafted LDAP traffic that bypasses authentication, then reads or manipulates identity data - creating, modifying, or deleting accounts the connector manages. Because OIM governs provisioning to downstream systems, the attacker can leverage this to escalate access across the enterprise. No public exploit code is identified in the provided data, and no user interaction or prior credentials are required (PR:N/UI:N).