Oracle Identity Manager EUVD-2026-106736

Exploitation requires network access to the LDAP Gateway component of the Oracle Identity Manager Connector, specifically reachable LDAP service endpoints on affected versions 12.2.1.4.0 or 14.1.2.1.0. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special non-default configuration are stated as prerequisites - it is described by Oracle as 'easily exploitable' by an unauthenticated attacker over LDAP. The primary limiting factor is reachability: the LDAP Gateway must be exposed to the attacker's network position, so deployments that restrict LDAP access to trusted internal segments or front it behind network controls materially reduce real-world exposure.

All available signals point to this being a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile: network-reachable, low attack complexity, no privileges, and no user interaction, with full High impact to Confidentiality, Integrity and Availability resulting in complete takeover of the Oracle Identity Manager Connector. Because the affected component is an identity/authentication gateway, a compromise has outsized blast radius - the product governs credentials and provisioning for downstream systems. However, several corroborating signals are MISSING from the input: no EPSS exploitation-probability score was provided, the vulnerability is not listed in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' CWE is 'N/A' and the only tag describing impact ('Information Disclosure') understates the actual full-takeover impact shown in the vector - treat the tag as unreliable. Net: prioritize patching based on the exposed, unauthenticated, network-facing attack surface, but note that there is currently no evidence of active exploitation or weaponization, so this is a patch-urgently-but-not-yet-exploited posture.

An attacker with network reachability to the LDAP Gateway component of the Oracle Identity Manager Connector sends crafted LDAP traffic to the exposed service without any credentials or user interaction. Exploitation succeeds against the affected versions (12.2.1.4.0 and 14.1.2.1.0) and results in full takeover of the Connector. No public exploit code is identified at time of analysis, so a working attack would currently require original development.