What is the CVSS score of CVE-2026-60532?

CVE-2026-60532 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Identity Manager are affected by CVE-2026-60532?

Oracle Identity Manager Connector in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 is vulnerable to complete remote takeover by unauthenticated attackers over HTTP, exposing organizations…

How to fix or mitigate CVE-2026-60532?

Within 24 hours, identify all systems running Oracle Identity Manager Connector versions 12.2.1.4.0 or 14.1.2.1.0 and implement firewall rules restricting HTTP access to authorized administrative networks only. Within 7 days, download and begin testing the Oracle July 2026 Critical Patch Update in non-production environments to verify compatibility with your PeopleSoft deployment. Within 30 days, deploy the patch to all affected production systems, completing the rollout with verification scans confirming all instances have been updated.

Oracle Identity Manager CVE-2026-60532

EUVD-2026-46894 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-fq9j-rrfr-x6m9

Privilege Escalation Oracle Identity Manager Connector

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated, easily exploitable HTTP attack with full connector takeover, giving AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; no cross-component scope change, so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:51 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.

Technical ContextAI

Oracle Identity Manager (OIM) is the identity governance and provisioning engine within Oracle Fusion Middleware; connectors are integration modules that reconcile and provision accounts between OIM and downstream target systems, here the PeopleSoft Applications connector. The flaw resides in this connector's network-facing HTTP handling and results in complete compromise of the connector component. Oracle does not map a CWE (listed as N/A) and, per its long-standing Critical Patch Update convention, does not disclose the specific root-cause class; based on the 'unauthenticated network takeover' phrasing this is consistent with an authentication/authorization bypass or unsafe request handling in the connector's web-exposed interface, but the exact weakness is not published.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes these as cumulative CPU patches for the affected 12.2.1.4.0 and 14.1.2.1.0 branches rather than as an independently tagged release, so identify the exact connector bundle patch listed in the CPU matrix for your version and deploy it during your next emergency-change window. Until patched, because the attack is remote and unauthenticated over HTTP, restrict network reachability of the connector's HTTP interface to only the OIM server and trusted management hosts via firewall/ACLs or a reverse proxy allowlist, and place it behind a WAF to filter anomalous requests - the trade-off is that overly tight ACLs can break legitimate PeopleSoft reconciliation/provisioning traffic, so validate connector jobs after locking down. If the PeopleSoft connector is not actively used, disable or undeploy it to remove the exposure entirely.