CVE-2026-60531 in Identity Manager Connector
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Identity Manager Connector component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.1.0. The flaw represents a critical security weakness that enables low privileged attackers to compromise the system through network-based HTTP access, demonstrating an easily exploitable nature that poses significant risk to enterprise identity management infrastructure. The vulnerability's classification as CVSS 3.1 Base Score 9.9 indicates its severe impact across confidentiality, integrity, and availability domains, making it a high-priority concern for security teams managing Oracle Fusion Middleware environments.
The technical exploitation of this vulnerability occurs through HTTP network connections, allowing attackers with minimal privileges to gain control over the Oracle Identity Manager Connector service. This represents a privilege escalation scenario where an attacker can leverage the flaw to achieve full system compromise. The scope change aspect indicates that successful exploitation may extend beyond the immediate target to impact additional Oracle products within the same ecosystem, potentially creating cascading security failures throughout the enterprise identity management infrastructure. The vulnerability's vector specification (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) demonstrates how network-based access with low privileges can lead to complete system compromise through HTTP protocols without requiring user interaction.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK techniques including T1078 (Valid Accounts) and T1566 (Phishing) as attackers may leverage compromised connector services to establish persistent access. The impact extends beyond the immediate connector service since Oracle Identity Manager Connector serves as a critical integration point for user provisioning and identity management across multiple enterprise applications, making successful exploitation particularly dangerous for organizations relying on centralized identity governance.
Organizations should implement immediate mitigations including network segmentation to restrict HTTP access to the connector service, deployment of web application firewalls to monitor and filter malicious requests, and implementation of strict access controls limiting who can interact with the Oracle Identity Manager Connector. Regular patching and updates should be prioritized to address this vulnerability, while monitoring systems should be configured to detect unusual authentication patterns or unauthorized access attempts. Security teams must also conduct comprehensive risk assessments to identify all systems that depend on the compromised connector service and develop incident response procedures for potential exploitation scenarios. The vulnerability's high severity score underscores the importance of proactive security measures and continuous monitoring of identity management infrastructure components.