What is the CVSS score of CVE-2026-60531?

CVE-2026-60531 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Identity Manager are affected by CVE-2026-60531?

Critical privilege escalation in Oracle Identity Manager Connector (CVE-2026-60531, CVSS 9.9) allows low-privileged attackers to fully compromise identity management systems; no public exploit…

How to fix or mitigate CVE-2026-60531?

Within 24 hours: Identify all systems running affected versions (12.2.1.4.0 and 14.1.2.1.0) and restrict network access to trusted internal sources only; evaluate whether the connector can be safely disabled if not actively required. Within 7 days: Enable comprehensive audit logging on the connector, implement network segmentation to isolate it from non-critical systems, establish daily log review procedures, and contact Oracle Support for patch timeline and interim guidance on CVE-2026-60531. Within 30 days: Apply vendor-released patch immediately upon availability via Oracle's Critical Patch Update channel; conduct full regression testing before returning to production; implement multi-factor authentication on all systems consuming identity services from the connector; and document rollback procedures for all interim compensating controls.

Oracle Identity Manager CVE-2026-60531

EUVD-2026-46893 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-9pph-6vxw-m33f

Authentication Bypass Oracle Identity Manager Connector

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

HTTP-reachable with a required low-privileged account (PR:L), no user interaction, and identity-broker scope change (S:C) yielding full CIA takeover of the connector and downstream systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:52 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with HTTP network access fully compromise the connector, with a scope change that lets the attack significantly impact other products. Oracle rates it CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical based on the vendor's July 2026 Critical Patch Update disclosure.

Technical ContextAI

Oracle Identity Manager (OIM) is the identity governance and administration component of Oracle Fusion Middleware, and Connectors are the integration modules that provision and reconcile identities/entitlements between OIM and external target systems (Active Directory, databases, SaaS apps, etc.). The flaw sits in the Connector 'Core' component and is reachable over HTTP, meaning it is exposed through OIM's web-facing management/provisioning interfaces. No CWE was assigned by NVD, so the precise weakness class (e.g., access-control bypass, injection, or deserialization) is not specified in the available data; the CVSS scope-change flag (S:C) indicates the vulnerable component can affect resources beyond its own security authority - consistent with an identity broker that holds privileged credentials for downstream systems it provisions.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch for the affected 12.2.1.4.0 and 14.1.2.1.0 Connector versions; Oracle does not publish an isolated fixed version number, so 'Patch available per vendor advisory' via the CPU is the correct target. Because exploitation requires a low-privileged authenticated session and HTTP reachability, interim compensating controls while patching include restricting network access to the OIM Connector/administration endpoints to trusted management networks or a VPN (trade-off: may disrupt legitimate remote provisioning integrations), tightening and auditing low-privilege OIM account provisioning and disabling unused or stale accounts to shrink the pool of accounts that meet the PR:L prerequisite, and increasing monitoring of Connector provisioning/reconciliation activity for anomalous privileged actions. Given the scope-change impact, also review and rotate credentials that OIM Connectors hold for downstream target systems if compromise is suspected.