CVE-2026-60534 in Identity Manager Connector
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Identity Manager Connector, a component of Oracle Fusion Middleware that integrates with PeopleSoft Applications, representing a significant security concern for enterprise identity management systems. The flaw affects specifically version 12.2.1.4.0 and 14.1.2.1.0, indicating a targeted issue within these release branches that have been widely deployed in enterprise environments. The vulnerability's classification as difficult to exploit suggests it requires specific conditions or prerequisites for successful exploitation, yet the attack vector through HTTP presents a network-based threat that could be leveraged by attackers with appropriate privileges.
The technical nature of this vulnerability stems from insufficient access controls within the Oracle Identity Manager Connector component, allowing a high-privileged attacker with network access to perform unauthorized operations against the system. This represents a critical flaw in the principle of least privilege enforcement, where proper authorization checks fail to prevent malicious actions. The CVSS 3.1 score of 7.7 indicates a serious security impact with high confidentiality and integrity implications, suggesting that attackers could gain unauthorized access to sensitive data or modify critical system information.
The operational impact of this vulnerability extends beyond the immediate Oracle Identity Manager Connector component, as indicated by the scope change designation that allows attacks to significantly affect additional products within the Oracle ecosystem. This cascading effect demonstrates how a single vulnerability in one component can potentially compromise entire enterprise identity management infrastructures, particularly given that Oracle Identity Manager Connector serves as an integration point for various applications and services. The potential for unauthorized creation, deletion, or modification of critical data represents a severe threat to organizational security posture and data integrity.
The attack scenario involves an attacker with high privileges and network access exploiting the connector's insufficient authorization mechanisms to gain unauthorized access to sensitive information or perform destructive operations against Oracle Identity Manager Connector accessible data. This vulnerability directly violates fundamental security principles and could enable attackers to compromise critical enterprise identity management systems, potentially leading to broader system infiltration or data breaches across interconnected Oracle applications.
Organizations should prioritize immediate patching of affected versions to address this vulnerability, while implementing network segmentation and access controls to limit exposure. The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) indicates that the attack requires high privileges but can be executed over a network with moderate complexity, emphasizing the need for layered security approaches. This vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving privilege escalation and credential access, particularly through service exploitation and identity management system compromise. Administrators should conduct thorough security assessments of their Oracle Identity Manager Connector deployments and implement monitoring solutions to detect potential exploitation attempts against these critical enterprise components.