CVE-2026-91491

Summary

This vulnerability allows unauthenticated attackers to fully compromise the Oracle Identity Manager Connector through LDAP, potentially leading to complete system takeover with high impacts on confidentiality, integrity, and availability.

Exploitability

The vulnerability is easily exploitable with no authentication required, allowing network-based attacks via LDAP against supported versions 12.2.1.4.0 and 14.1.2.1.0.

Blast radius

Successful exploitation could lead to complete takeover of the Oracle Identity Manager Connector, potentially affecting identity management across the enterprise and enabling further lateral movement through compromised credentials.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Oracle Fusion Middleware 12.2.1.4.0 or 14.1.2.1.0 with the latest patches for the LDAP Gateway component.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.