Oracle IDM Connector EUVD-2026-106738

Exploitation requires network reachability to the LDAP Gateway component of the Oracle Identity Manager Connector (affected versions 12.2.1.4.0 and 14.1.2.1.0); the gateway must be deployed and accessible over LDAP to the attacker. No authentication, no privileges, and no user interaction are required (PR:N/UI:N), so default network-exposed deployments of the LDAP Gateway are exploitable. The primary limiting factor is network exposure: environments that restrict LDAP Gateway access to trusted internal segments or front it with network controls substantially reduce reachability. Impact is confined to confidentiality - unauthorized read access to connector-accessible data - with no integrity or availability effect.

This is a genuine but bounded priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an easily exploitable, network-reachable, unauthenticated flaw requiring no user interaction - the most favorable possible conditions for an attacker - which is why Oracle rates it 7.5. However, impact is strictly confidentiality (C:H/I:N/A:N): the flaw yields unauthorized read access to Identity Manager Connector data, not code execution or data tampering. Critically, several escalation signals are MISSING rather than negative: no EPSS probability, no SSVC decision data, and no CISA KEV listing were provided, and there is no public exploit identified at time of analysis. The absence of KEV/POC data means this is not confirmed to be under active exploitation - it should be treated as a high-value patching target (unauthenticated confidentiality breach of an identity/IAM product is serious given the sensitivity of IAM data) but not an emergency on exploitation-probability grounds. One conflict to verify: the input Tag 'Authentication Bypass' is not corroborated by the CVSS vector, which shows no integrity impact (I:N); verify with Oracle whether this is true authentication bypass or simply pre-authentication data disclosure.

An attacker with network access to the Oracle Identity Manager Connector's LDAP Gateway sends crafted LDAP requests without any credentials and, because no authentication or user interaction is required, retrieves critical identity-related data accessible to the connector. No public exploit code has been identified at time of analysis, so exploitation would currently require independent research or reverse-engineering of the Oracle October 2026 CPU fix.