CVE-2026-60994 in Identity Manager Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Core component of Oracle Identity Manager Connector, a critical element of the Oracle Fusion Middleware suite affecting versions 12.2.1.4.0 and 14.1.2.1.0. This security flaw represents a significant risk to organizations relying on this platform for identity governance and access management operations. The nature of the vulnerability is characterized by its difficulty to exploit, which necessitates specific environmental conditions and user interaction before an attack can be successfully executed. Despite these constraints, the potential impact of a successful exploitation is severe, affecting both the confidentiality and integrity of data managed by the system while leaving availability largely unaffected according to the provided metrics.
From a technical perspective, the vulnerability allows for compromise by an attacker who holds low privileges within the infrastructure where Oracle Identity Manager Connector executes. This indicates that the flaw likely stems from improper access control checks or insufficient validation mechanisms when processing inputs or managing resources at a lower privilege level. The requirement for human interaction suggests that the attack vector may involve social engineering tactics, such as convincing a legitimate user to perform an action like clicking a malicious link, opening a crafted file, or approving a deceptive request within the interface. This dependency on non-attacker interaction serves as a partial mitigation but does not eliminate the risk entirely, particularly in environments where users are frequently targeted by phishing campaigns or insider threats with low-level access rights.
The operational impact of this vulnerability is substantial due to its scope change characteristic. Although the flaw exists within Oracle Identity Manager Connector itself, successful exploitation can lead to compromised state changes that significantly affect additional products integrated into the broader identity management ecosystem. This lateral movement capability means that a breach in one component can cascade through connected systems, amplifying the damage beyond the immediate application boundary. The primary consequences involve unauthorized creation, deletion, or modification of critical data accessible by Oracle Identity Manager Connector. Furthermore, attackers may gain complete access to all such data, leading to severe breaches of confidentiality and integrity for sensitive identity information, user credentials, and organizational policies stored within the system.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management or potentially CWE-787 Out-of-bounds Write if memory corruption is involved in the low-level exploitation path, though the description emphasizes access control failures more heavily. The requirement for human interaction maps directly to ATT&CK technique T1548 Abuse of Configuration, where an attacker leverages trusted user actions to bypass security controls. Additionally, the ability to modify and delete critical data corresponds to ATT&CK tactics TA0003 Persistence or TA0007 Discovery depending on whether the goal is long-term access or information gathering before exfiltration. The high confidentiality and integrity impacts underscore the importance of treating this as a critical threat to organizational security posture, especially given the central role Oracle Identity Manager plays in enterprise identity lifecycles.
Mitigation strategies should focus primarily on patching the affected versions 12.2.1.4.0 and 14.1.2.1.0 with the latest available updates from Oracle that address this specific Core component flaw. In addition to software remediation, organizations must enforce strict least-privilege principles for all accounts interacting with the infrastructure hosting Oracle Identity Manager Connector. This includes auditing low-privileged user activities and implementing multi-factor authentication to reduce the success rate of social engineering attacks that require human interaction. Network segmentation should also be reviewed to limit lateral movement capabilities in case a compromise occurs, ensuring that even if an attacker gains access through this vulnerability, their ability to impact additional products is contained within isolated zones. Continuous monitoring for anomalous data modifications or unauthorized access patterns can provide early detection of exploitation attempts before significant damage occurs.