CVE-2026-91491: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-91491 is a critical vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically affecting the LDAP Gateway component. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows an unauthenticated attacker with network access via LDAP to fully compromise the Oracle Identity Manager Connector, potentially resulting in complete system takeover. It was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update (CPU), with a CVSS v3.1 base score of 9.8 (Critical) (Oracle CPU Oct 2026).

The vulnerability resides in the LDAP Gateway component of Oracle Identity Manager Connector, which fails to properly validate or sanitize input received over the LDAP protocol. This allows an unauthenticated, remote attacker to send malicious LDAP requests that result in arbitrary operations being executed on the connector system. No authentication, user interaction, or elevated privileges are required, and the attack complexity is low, making this trivially exploitable from any network-accessible position. Oracle has not publicly disclosed the specific root cause (CWE classification) or detailed technical mechanics, and no public proof-of-concept code has been identified (Oracle CPU Oct 2026).

Successful exploitation results in a full takeover of the Oracle Identity Manager Connector, with high impact to confidentiality, integrity, and availability. An attacker can read sensitive identity and directory data managed by the connector, modify system configurations and provisioned data, and disrupt service availability. Given that Oracle Identity Manager Connector is typically integrated with enterprise identity and access management infrastructure, compromise could facilitate lateral movement into connected LDAP directories, downstream provisioned systems, and broader IAM workflows (Oracle CPU Oct 2026).

There is no public proof-of-concept exploit code known at this time, and no evidence of in-the-wild exploitation has been reported. The EPSS score is 0.0, reflecting the current absence of observed exploitation activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the combination of network accessibility, no authentication requirement, and low attack complexity makes this a high-priority target if exploitation details become public (Oracle CPU Oct 2026).

Oracle has released patches for affected versions 12.2.1.4.0 and 14.1.2.1.0 as part of the October 2026 Critical Patch Update. Organizations should apply the relevant patches immediately via the Oracle support portal. As a temporary workaround, Oracle recommends blocking network access to the LDAP port used by the Oracle Identity Manager Connector from untrusted sources, and restricting LDAP connections to known, trusted IP ranges only. Oracle strongly cautions that network-level blocking is not a permanent fix and does not address the underlying vulnerability (Oracle CPU Oct 2026).