Zero Radar
← feed
CriticalVulnerabilityCVE-2026-91491updated 25 Oct 2026, 18:50 UTC

Oracle Identity Manager Connector can be taken over by unauthenticated attackers

Anyone on the network who can reach the LDAP Gateway component can take control of the connector without logging in. The connector manages user accounts, so this puts those accounts at risk.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNeeds only network access via LDAP
  2. 2LDAP requestSent to the LDAP Gateway component
  3. 3Connector flawEasily exploitable, no login needed
  4. 4Connector compromisedAttacker gains control of the product
  5. ResultAttacker takes over the connector

What happened

Oracle Identity Manager Connector, component LDAP Gateway, has an easily exploitable flaw that lets an unauthenticated attacker with network access via LDAP fully compromise the product.

Why it is dangerous: A successful attack can lead to full takeover of the connector, affecting confidentiality, integrity and availability. Organizations using it for identity management are at risk.

Are you affected?

You are affected if you run Oracle Identity Manager Connector 12.2.1.4.0 or 14.1.2.1.0 with the LDAP Gateway component reachable over the network.

Oracle Identity Manager Connector (LDAP Gateway component): 12.2.1.4.0 and 14.1.2.1.0

What to do

  1. Check whether Oracle Identity Manager Connector 12.2.1.4.0 or 14.1.2.1.0 is in use
  2. Restrict network access to the LDAP Gateway so only trusted hosts can reach it
  3. Check Oracle's Critical Patch Update advisories or the GitHub advisory for a fixed version and apply it

Timeline

  1. 20 Oct 2026, 22:20 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:20 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-91491 · GHSA-c2vp-mgg4-vg5v
CVSS
9.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:20 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Identity Manager Connector can be taken over by unauthenticated attackers · Zero Radar