CVE-2026-91493: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-91493 is an authentication bypass vulnerability in the LDAP Gateway component of Oracle Identity Manager Connector, part of Oracle Fusion Middleware. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via LDAP can exploit this vulnerability to gain unauthorized access to critical data or complete access to all data accessible through the connector. It carries a CVSS v3.1 base score of 7.5 (High), with impacts limited to confidentiality (Oracle Advisory).

The vulnerability resides in the LDAP Gateway component of Oracle Identity Manager Connector and is classified as an authentication bypass (CWE not explicitly specified by Oracle). The flaw allows an unauthenticated remote attacker to interact with the LDAP Gateway over the network without requiring any credentials or user interaction, indicating insufficient authentication enforcement at the LDAP interface level. Attack complexity is low, requiring no special privileges, making it straightforward to exploit by any network-accessible attacker. Oracle has not publicly disclosed detailed technical write-ups or proof-of-concept code (Oracle Advisory).

Successful exploitation results in unauthorized read access to critical data or complete access to all data accessible through Oracle Identity Manager Connector, representing a high confidentiality impact. Since Oracle Identity Manager Connector manages identity and directory data (typically including user credentials, group memberships, and organizational data via LDAP), exposure of this information could facilitate lateral movement, privilege escalation, or further attacks against connected identity infrastructure. Integrity and availability are not impacted by this vulnerability (Oracle Advisory).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation reported at this time. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the absence of known exploits, the low attack complexity and lack of authentication requirements make this vulnerability relatively easy to exploit if network access to the LDAP Gateway is available (Oracle Advisory).

Oracle has released patches for CVE-2026-91493 as part of the October 2026 Critical Patch Update (CPU), addressing versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager Connector. Organizations should apply the October 2026 CPU immediately. As a temporary workaround, restrict network access to the LDAP Gateway component to only trusted hosts and implement network segmentation to limit exposure. Oracle strongly recommends against relying on network-level blocking as a long-term solution, as it does not address the underlying vulnerability (Oracle Advisory).