CVE-2026-91490: Oracle Identity Manager Authentication Bypass

CVE-2026-91490 Overview

CVE-2026-91490 is an authentication vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically within the LDAP Gateway component. The flaw allows an unauthenticated attacker with network access via Lightweight Directory Access Protocol (LDAP) to compromise the Oracle Identity Manager Connector. Successful exploitation grants attackers unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Identity Manager Connector accessible data. The vulnerability is tracked under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated remote attackers can compromise identity management data integrity and confidentiality through the LDAP Gateway, affecting the trust boundary of enterprise identity infrastructure.

Affected Products

Oracle Identity Manager Connector 12.2.1.4.0
Oracle Identity Manager Connector 14.1.2.1.0
Oracle Fusion Middleware (LDAP Gateway component)

Discovery Timeline

2026-10-20 - CVE-2026-91490 published to NVD
2026-10-21 - Last updated in NVD database
October 2026 - Addressed in Oracle Critical Patch Update (Oracle Security Alert - October 2026)

Technical Details for CVE-2026-91490

Vulnerability Analysis

The vulnerability resides in the LDAP Gateway component of the Oracle Identity Manager Connector. The LDAP Gateway acts as a protocol bridge that allows LDAP clients to interact with Oracle Identity Manager as if it were a native directory service. Improper authentication handling in this gateway allows attackers to bypass identity verification entirely when issuing LDAP operations.

Because the Oracle Identity Manager Connector mediates provisioning and identity data across downstream systems, a compromise of the gateway exposes credentials, group memberships, entitlements, and other identity records. Attackers can both read sensitive identity data and modify or delete records, undermining the integrity of identity governance workflows.

Root Cause

The root cause is improper authentication [CWE-287] in the LDAP Gateway listener. The gateway fails to adequately validate the identity of connecting clients before processing LDAP bind, search, add, modify, and delete operations. Oracle has not published implementation-level details beyond the Critical Patch Update advisory.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker with network reachability to the LDAP Gateway listener can send crafted LDAP requests to exercise the vulnerable code path. Because many deployments expose LDAP listeners to internal networks and sometimes to partner networks, the exposed attack surface is often broad. See the Oracle Security Alert - October 2026 for vendor details.

Detection Methods for CVE-2026-91490

Indicators of Compromise

Unexpected LDAP bind, search, or modify operations originating from unknown or non-provisioned source hosts.
Unauthorized creation, deletion, or attribute modification of user, group, or role objects in Oracle Identity Manager.
Spikes in LDAP traffic to the Identity Manager Connector gateway outside normal provisioning windows.
Oracle Identity Manager audit records showing operations without a corresponding authenticated session.

Detection Strategies

Review Oracle Identity Manager Connector logs for anonymous or malformed LDAP bind requests preceding privileged operations.
Correlate LDAP Gateway activity with Oracle Identity Manager audit trails to identify operations lacking a validated principal.
Compare provisioning changes against change-management records to flag out-of-band modifications.

Monitoring Recommendations

Forward LDAP Gateway and Oracle Identity Manager audit logs to a centralized logging platform for retention and correlation.
Alert on identity object modifications that do not map to approved provisioning workflows or ticketed changes.
Monitor network flows to TCP ports hosting the LDAP Gateway and alert on connections from unexpected subnets.

How to Mitigate CVE-2026-91490

Immediate Actions Required

Apply the fixes delivered in the Oracle Critical Patch Update of October 2026 to all affected Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory LDAP Gateway listeners and verify network exposure, restricting reachability to known provisioning hosts only.
Rotate any credentials or secrets that may have been accessible through the LDAP Gateway during the exposure window.
Review Oracle Identity Manager audit history for unauthorized object creations, deletions, or modifications.

Patch Information

Oracle addressed CVE-2026-91490 in the October 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert - October 2026 advisory for exact patch identifiers, prerequisites, and version-specific installation guidance for the 12.2.1.4.0 and 14.1.2.1.0 branches.

Workarounds

Restrict network access to the LDAP Gateway using firewall rules or network segmentation until patches are applied.
Place the LDAP Gateway behind an authenticated reverse proxy or VPN to enforce an additional authentication layer.
Disable the LDAP Gateway component if it is not required for active provisioning or synchronization workflows.
Enable verbose LDAP Gateway auditing to retain forensic evidence while mitigations are deployed.