CVE-2026-91494: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-91494 is a vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically affecting the LDAP Gateway component. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via TCP can exploit this difficult-to-exploit vulnerability to compromise the connector, resulting in unauthorized access to or modification of critical data. It carries a CVSS v3.1 base score of 7.4 (High) (Oracle Advisory).

The vulnerability resides in the LDAP Gateway component of Oracle Identity Manager Connector, which handles directory service communications over TCP. The attack vector is network-based, requires no authentication or user interaction, but is classified as high complexity (AC:H), meaning specific conditions or race conditions must be met for successful exploitation. Oracle has not publicly disclosed the precise root cause or CWE classification, consistent with its standard vulnerability disclosure policy. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data accessible to Oracle Identity Manager Connector, as well as complete unauthorized read access to all data within the connector's scope. Given that Oracle Identity Manager Connector manages identity provisioning and LDAP directory integrations, a compromise could expose sensitive user credentials, directory entries, and identity lifecycle data, with potential for lateral movement into connected identity stores or provisioned systems. Availability is not impacted according to the CVSS scoring (Oracle Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of disclosure. The EPSS score is 0.0, reflecting very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity requirement (AC:H) reduces the likelihood of opportunistic exploitation (Oracle Advisory).

Oracle released a patch for this vulnerability as part of the October 2026 Critical Patch Update (CPU), available as of October 20, 2026, for affected versions 12.2.1.4.0 and 14.1.2.1.0. Oracle strongly recommends applying the CPU patches immediately. As a temporary measure prior to patching, network access to the LDAP Gateway component should be restricted to trusted IP ranges only. Monitoring Identity Manager Connector logs for unusual authentication attempts or anomalous data access patterns is also advised (Oracle Advisory).