CVE-2026-60535 in Identity Manager Connector
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Identity Manager Connector, a component of Oracle Fusion Middleware that integrates with PeopleSoft Applications to manage identity and access controls. The flaw exists in the connector's HTTP handling mechanism, creating a critical security weakness that affects specifically versions 12.2.1.4.0 and 14.1.2.1.0 of the software. The vulnerability represents a severe configuration oversight where the system fails to properly authenticate incoming requests, allowing any network-based attacker to exploit this weakness without requiring valid credentials or prior access privileges.
The technical nature of this flaw falls under CWE-287, which addresses improper authentication issues within software systems. Attackers can leverage this vulnerability through unauthenticated HTTP connections to execute arbitrary commands on the affected Oracle Identity Manager Connector instance. The CVSS 3.1 scoring of 9.8 indicates the highest severity level with complete impacts across confidentiality, integrity, and availability domains, making it an extremely dangerous weakness that could lead to full system compromise. The attack vector requires only network access via HTTP protocols, eliminating any need for additional reconnaissance or privileged access.
The operational impact of this vulnerability is catastrophic for organizations relying on Oracle Identity Manager Connector for their identity management infrastructure. Successful exploitation allows attackers to gain complete control over the connector service, potentially enabling them to modify user accounts, access sensitive data, manipulate authentication processes, and establish persistence within the enterprise environment. Given that this connector typically interfaces with PeopleSoft applications, attackers could leverage this access to undermine the entire identity management ecosystem, potentially leading to broader system compromises. The vulnerability's ease of exploitation means that even automated attack tools could successfully compromise affected systems without significant technical expertise.
Organizations should immediately implement network-level restrictions to limit access to Oracle Identity Manager Connector services only to trusted networks and IP addresses. The most effective mitigation involves applying the relevant Oracle security patches released through their official patch advisory process, which would address the underlying authentication flaw in the HTTP handling component. Additional protective measures include implementing network segmentation, deploying web application firewalls to monitor and filter HTTP traffic, and conducting comprehensive network scans to identify any potential exploitation attempts. Security teams should also review and tighten access controls around PeopleSoft applications that rely on this connector, ensuring that any compromised systems are immediately isolated from critical enterprise resources. The vulnerability demonstrates the importance of maintaining up-to-date security patches and proper network segmentation as fundamental defense-in-depth strategies against such critical access control failures.