CVE-2026-60993 in Identity Manager Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Core component of Oracle Identity Manager Connector, a critical element of the Oracle Fusion Middleware suite used for managing digital identities and access across enterprise environments. This flaw affects specific supported versions including 12.2.1.4.0 and 14.1.2.1.0. The nature of this vulnerability is characterized by its difficulty to exploit, which suggests that while the underlying technical weakness may be complex or require precise conditions to trigger, it nonetheless presents a severe risk when those conditions are met. The primary characteristic distinguishing this threat vector is the requirement for physical proximity; an attacker must have access to the physical communication segment attached to the hardware where the Oracle Identity Manager Connector executes. This constraint significantly limits the attack surface compared to remote network-based exploits but does not eliminate the severity of the potential compromise, particularly in environments with insufficient physical security controls or shared infrastructure segments.
From a technical perspective, this vulnerability allows an unauthenticated attacker to achieve complete takeover of the Oracle Identity Manager Connector process. The absence of authentication requirements means that no valid credentials are needed to initiate the attack sequence, relying instead on protocol-level flaws or misconfigurations within the communication channel itself. Once exploited, the attacker gains full control over the connector service, which serves as a bridge between identity management systems and various target applications or directories. This level of access enables the manipulation of identity data, modification of access policies, and potential lateral movement into other connected systems that rely on this connector for authentication and authorization services. The operational impact is profound, encompassing confidentiality, integrity, and availability impacts as reflected in the high severity rating.
The CVSS 3.1 Base Score of 7.5 indicates a High severity level, driven by the vector string AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The Attack Vector (AV) being Adjacent highlights the physical or local network segment requirement, while Access Complexity (AC) being High suggests that successful exploitation requires specialized conditions or timing. However, the lack of required privileges (PR:N), user interaction (UI:N), and unchanged scope (S:U) combined with high impacts on confidentiality, integrity, and availability results in a significant risk profile. This vulnerability aligns with CWE-287 Improper Authentication, as it allows unauthenticated access to critical functionality, and potentially CWE-434 Unrestricted Upload of File with Dangerous Type if the takeover involves uploading malicious payloads or configurations. In terms of MITRE ATT&CK mapping, this behavior corresponds to techniques involving Local Privilege Escalation or Account Manipulation, specifically within the context of adjacent network attacks where an adversary leverages physical access to compromise identity infrastructure components.
Mitigation strategies must focus on both technical controls and physical security measures since remote exploitation is not feasible due to the adjacency requirement. Organizations should prioritize restricting physical access to servers hosting Oracle Identity Manager Connectors, ensuring that data centers and server rooms adhere to strict entry protocols and surveillance standards. Network segmentation plays a crucial role in limiting exposure; administrators should isolate identity management infrastructure on dedicated VLANs or subnets with minimal external connectivity and enforce strict firewall rules that limit traffic to only necessary ports from trusted sources. Additionally, implementing mutual TLS authentication for all internal communications can mitigate risks associated with unauthenticated access even if physical boundaries are breached. Regular patching is essential, so applying the latest security updates provided by Oracle for versions 12.2.1.4.0 and 14.1.2.1.0 will address the underlying code flaws enabling this vulnerability. Continuous monitoring of system logs for anomalous connection attempts or unauthorized configuration changes can also aid in early detection and response to potential exploitation activities targeting these connectors.