CVE-2026-60991 in Identity Manager Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Core component of Oracle Identity Manager Connector, a critical element of the Oracle Fusion Middleware suite used for managing digital identities and access across enterprise environments. This flaw affects specific supported versions including 12.2.1.4.0 and 14.1.2.1.0, indicating that even recently maintained releases are susceptible to exploitation. The nature of this vulnerability allows a low-privileged attacker who has already established logon access to the infrastructure where the Oracle Identity Manager Connector executes to compromise the connector itself. This scenario highlights a significant trust boundary failure within the middleware architecture, where lateral movement from a lower-level compromised system can lead directly to the elevation of privileges and control over identity management processes.
From a technical perspective, the vulnerability enables an attacker with local access on the host machine running the connector service to execute arbitrary code or manipulate memory in a way that results in full takeover of the Oracle Identity Manager Connector process. The operational impact is severe, as indicated by a CVSS 3.1 Base Score of 7.8, which classifies it as High severity. This score reflects high impacts on Confidentiality, Integrity, and Availability. An attacker who successfully exploits this flaw can read sensitive identity data, modify authentication policies or user attributes to maintain persistent access, and disrupt the availability of identity services for other users within the organization. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that no user interaction is required and the attack complexity is low once local access is achieved, making it a potent threat in environments where internal network segmentation or host-based security controls are insufficient.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection, if the exploitation involves executing system commands through the connector interface. Alternatively, depending on the specific memory corruption mechanism involved, it may also relate to CWE-120 Buffer Overflow or CWE-94 Improper Control of Generation of Code (Code Injection). In terms of adversary behavior, this aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter for initial execution after gaining local access, followed by T1068 Exploitation for Privilege Escalation if the connector process runs with elevated privileges. The ability to take over the connector allows an attacker to pivot into other connected systems managed by Oracle Identity Manager, effectively bypassing perimeter defenses that rely on identity-based authentication controls.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. Oracle should be consulted for the latest security patches or updates specifically addressing this vulnerability in versions 12.2.1.4.0 and 14.1.2.1.0, as applying vendor-provided fixes is the most effective way to close the code-level flaw. In addition to patching, organizations should enforce strict least-privilege principles for accounts that have logon access to infrastructure hosting Oracle Identity Manager Connectors. Network segmentation should be implemented to restrict lateral movement between general-purpose servers and identity management hosts. Furthermore, monitoring tools should be configured to detect unusual process creation or privilege escalation events associated with the connector executable, providing an additional layer of defense in depth against exploitation attempts that may bypass preventive controls.