Oracle Identity Manager Connector CVE-2026-60533

Exploitation requires the attacker to have access to the physical communication segment (adjacent network) attached to the hardware where the Oracle Identity Manager Connector executes - remote internet-only attackers cannot reach it (AV:A). No authentication is required (PR:N) and no user interaction is needed (UI:N), but the attack is rated high complexity (AC:H), meaning success depends on specific, hard-to-control conditions such as timing or connector state rather than a straightforward request. Only OIM Connector versions 12.2.1.4.0 and 14.1.2.1.0 running the Generic Unix Connector component are in scope; the adjacency requirement and high complexity are the primary factors limiting real-world exploitation.

The signals are mixed and should be weighed together rather than by score alone. CVSS 3.1 is 8.0 (High), but the vector reveals meaningful constraints: AV:A limits the attacker to the adjacent physical communication segment (not remote internet exploitation), and AC:H means Oracle itself rates the attack as difficult, likely requiring specific timing, state or environmental conditions. Offsetting factors that inflate the score are PR:N (no authentication), UI:N (no user interaction), and S:C (scope change into additional products) with High Integrity and High Availability impact; confidentiality impact is None. No EPSS score was provided, the CVE is not in CISA KEV, and no public proof-of-concept was identified, so there is no evidence of active or imminent exploitation. Net assessment: this is a genuine High-severity issue for organizations where the OIM Connector host shares a LAN segment with untrusted or lightly controlled devices, but the adjacent-only vector plus high complexity make it a lower practical priority than a network-reachable, low-complexity flaw. The 'Denial Of Service' tag aligns with the A:H impact.

An attacker who has gained a foothold on a device sharing the local/adjacent network segment with the OIM Generic Unix Connector host sends specially crafted traffic to the connector's communication interface. Despite the high complexity, a successful attempt lets them tamper with provisioned account data or trigger a repeatable crash of the connector, and via the scope change disrupt or corrupt additional integrated identity systems. No public exploit code has been identified, so this would require original development against the adjacent interface.