What is the CVSS score of CVE-2026-60533?

CVE-2026-60533 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Identity Manager Connector are affected by CVE-2026-60533?

Oracle Identity Manager Connector (Generic Unix Connector) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 is vulnerable to network-adjacent attackers who can corrupt identity data, disrupt…

How to fix or mitigate CVE-2026-60533?

Within 24 hours, audit systems for affected versions (12.2.1.4.0 and 14.1.2.1.0) and restrict network access to Generic Unix Connector components from untrusted adjacent segments using firewall rules or network segmentation. Within 7 days, enforce strict access controls on connector administration, deploy comprehensive logging and alerting for connector data operations to detect unauthorized modifications, and perform impact analysis on all applications and systems consuming connector data. Within 30 days, monitor Oracle's advisory channels for patch releases, evaluate replacement or re-architecture of connector infrastructure, develop tested incident response procedures for identity connector compromise, and consider isolating critical identity systems until patches are available.

Oracle Identity Manager Connector CVE-2026-60533

EUVD-2026-46895 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wvr5-8gxp-7wm2

Authentication Bypass Oracle Identity Manager Connector

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

vuln.today AI

8.0 HIGH

Adjacent-segment access gives AV:A, vendor-rated difficulty gives AC:H, no auth or interaction gives PR:N/UI:N, cross-product effect gives S:C, and impacts are integrity/availability only (C:N/I:H/A:H).

3.1 AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:51 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Identity Manager Connector. CVSS 3.1 Base Score 8.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H).

AnalysisAI

Integrity and availability compromise in the Oracle Identity Manager Connector (Generic Unix Connector component) of Oracle Fusion Middleware allows an unauthenticated attacker positioned on the adjacent physical communication segment to modify, create or delete connector-accessible data and to cause a complete, repeatable denial of service. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, and because of a scope change the attack may significantly impact additional integrated products beyond the connector itself. There is no public exploit identified at time of analysis; the flaw is rated CVSS 3.1 8.0 despite high attack complexity.

Technical ContextAI

The Oracle Identity Manager (OIM) Connector is an identity-provisioning bridge within Oracle Fusion Middleware that synchronizes accounts and entitlements between OIM and target systems; the affected component is the Generic Unix Connector, which manages user and account lifecycle operations against Unix-style target hosts. The CVSS vector (AV:A, S:C) indicates the weakness is reachable only from the adjacent network/physical segment attached to the hardware running the connector, and that successful exploitation crosses a trust boundary to affect other components. No CWE was assigned by NVD, but the described effects - unauthorized data creation/deletion/modification plus a complete hang or crash - are consistent with an unauthenticated protocol- or input-handling defect in the connector's communication layer that permits both data tampering and resource exhaustion. Oracle disclosed the issue through its July 2026 Critical Patch Update.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update; patch is available per vendor advisory (https://www.oracle.com/security-alerts/cpujul2026.html), though the intelligence provided does not contain an exact post-patch build number, so obtain the precise patched version from that advisory for your specific release train (12.2.1.4.0 or 14.1.2.1.0). Because exploitation requires access to the adjacent physical communication segment, the most effective compensating control until patching is network segmentation: isolate the host running the OIM Generic Unix Connector onto a dedicated, tightly controlled VLAN and restrict layer-2/adjacent access to only trusted management systems, accepting the operational overhead of managing an additional segment. Additionally restrict and monitor traffic to the connector's communication ports and keep the connector host off shared or user-accessible LAN segments; the trade-off is added routing/firewall complexity but a substantially reduced attack surface given the AV:A constraint.