CVE-2026-60536 in Identity Manager Connector
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Identity Manager Connector, a component of Oracle Fusion Middleware that integrates with PeopleSoft Applications, representing a critical security weakness in enterprise identity management infrastructure. The flaw exists in versions 12.2.1.4.0 and 14.1.2.1.0, making them susceptible to exploitation by unauthenticated attackers who can leverage network-based HTTP access to compromise the system. This represents a significant risk as Oracle Identity Manager Connector serves as a bridge between identity management systems and various enterprise applications, potentially providing attackers with elevated privileges and access to sensitive user data.
The technical nature of this vulnerability stems from inadequate authentication mechanisms within the connector component, allowing attackers to bypass normal access controls without requiring valid credentials or prior authorization. The CVSS 3.1 score of 8.6 reflects the high severity impact, specifically targeting confidentiality impacts with a base score of 8.6, indicating that successful exploitation could lead to unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. The attack vector AV:N indicates network-based attacks are possible, while AC:L shows low attack complexity and PR:N demonstrates no privilege requirements for exploitation. The scope change aspect of this vulnerability means that attacks may impact additional products beyond the immediate target, potentially affecting other components within the Oracle Fusion Middleware ecosystem.
The operational impact of this vulnerability extends far beyond the immediate connector component, as it can compromise entire identity management workflows and potentially provide attackers with access to sensitive employee data, user credentials, and privileged system information. Organizations relying on PeopleSoft Applications integrated with Oracle Identity Manager Connector face significant risks including data breaches, unauthorized system access, and potential lateral movement within their network infrastructure. The vulnerability's ability to impact additional products makes it particularly dangerous as it could enable attackers to escalate privileges and access other systems within the same enterprise environment.
Mitigation strategies should include immediate patching of affected Oracle Identity Manager Connector versions to address the authentication bypass flaw, implementation of network segmentation to limit access to the connector component, and enhanced monitoring of HTTP traffic for suspicious activities. Organizations should also review their identity management configurations to ensure least privilege access controls are properly implemented. According to CWE standards, this vulnerability aligns with CWE-287 which covers improper authentication issues, while ATT&CK framework would categorize this under initial access techniques where adversaries exploit weak or missing authentication mechanisms to gain unauthorized access to systems. Additionally, implementing network-based firewalls and access control lists specifically targeting the connector's HTTP endpoints can provide additional protective layers against exploitation attempts.