Identity Manager Connector CVE-2026-91494

Exploitation requires network (TCP) reachability to the LDAP Gateway component of the Oracle Identity Manager Connector; the gateway listener must be deployed and accessible to the attacker. Affected deployments are specifically versions 12.2.1.4.0 and 14.1.2.1.0. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the high attack complexity (AC:H, 'difficult to exploit' per Oracle) is the key limiting factor: the attacker must satisfy preconditions outside their direct control, which substantially reduces reliable, repeatable exploitation. Impact is limited to confidentiality and integrity of connector-accessible data; there is no availability impact (A:N).

This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.4 is driven by network reach (AV:N), no privileges (PR:N), no user interaction (UI:N), and high confidentiality and integrity impact (C:H/I:H), but it is materially tempered by high attack complexity (AC:H) - Oracle itself labels it 'difficult to exploit,' meaning conditions exist beyond the attacker's control. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation; exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting: a high-impact, unauthenticated, network-facing flaw that is hard to actually trigger. Note one tension - the record carries an 'Authentication Bypass' tag while the Oracle description characterizes the issue only as unauthenticated compromise of the connector via the LDAP Gateway, without explicitly describing an auth-bypass mechanism; treat the tag as unverified. Because this affects an identity-management component (a high-value target whose compromise can cascade into account creation/deletion), the combination of unauthenticated access and full C/I impact warrants prompt patching during the next Oracle CPU cycle even though AC:H and the absence of exploitation signals argue against emergency out-of-band action.

A remote, unauthenticated attacker with TCP network access to the Oracle Identity Manager Connector's LDAP Gateway sends specially crafted traffic that, under the specific conditions required to win the high-complexity attack, lets them read and modify critical identity data - potentially creating or deleting managed accounts. No public exploit code is known at the time of analysis, and the high attack complexity means exploitation likely requires meeting non-trivial preconditions (e.g., timing, specific configuration, or multiple attempts).