What is the CVSS score of CVE-2026-60534?

CVE-2026-60534 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Identity Manager are affected by CVE-2026-60534?

A high-severity vulnerability in Oracle Identity Manager Connector (Oracle Fusion Middleware 12.2.1.4.0, 14.1.2.1.0) enables privileged insiders to read, modify, or delete identity data with scope…

How to fix or mitigate CVE-2026-60534?

Within 24 hours: conduct inventory of Oracle Fusion Middleware deployments to confirm affected versions (12.2.1.4.0 or 14.1.2.1.0) and document access privileges of system administrators. Within 7 days: implement network segmentation isolating Oracle Fusion Middleware systems, enable enhanced logging/alerting on all identity connector operations, and restrict administrator privilege scope to least-privilege principles. Within 30 days: engage Oracle support for mitigation guidance and timeline to patched versions, evaluate upgrade feasibility to unaffected versions, and implement privileged access management (PAM) controls for all high-privilege identity system accounts.

Oracle Identity Manager CVE-2026-60534

EUVD-2026-46896 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-cxxq-f8cf-vf6c

Authentication Bypass Oracle Identity Manager Connector

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

7.7 HIGH

Network HTTP reach but 'difficult to exploit' gives AC:H, high-privileged attacker required so PR:H, connector's trust-bridge role yields S:C with C:H/I:H and no availability impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:51 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Privileged tampering and data disclosure in the Oracle Identity Manager Connector (PeopleSoft Applications component) of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 lets a high-privileged, network-based attacker read, create, delete, or modify all connector-accessible data, with a scope change that can significantly impact additional products beyond the connector itself. The CVSS 3.1 base score is 7.7 (C:H/I:H/A:N), but exploitation is rated high-complexity and requires existing high privileges, so this is not a drive-by flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Identity Manager (OIM) is the identity-governance and provisioning tier of Oracle Fusion Middleware; its connectors bridge OIM to downstream target systems for account provisioning and reconciliation. The affected component is the PeopleSoft Applications connector, which synchronizes identities and entitlements between OIM and Oracle/PeopleSoft enterprise applications over HTTP. Because a connector operates as a trusted provisioning bridge with broad access to identity data across systems, a flaw here can cross trust boundaries - reflected in the CVSS scope change (S:C). Oracle publishes no CWE for this entry (CWE: N/A) and gives no code-level root cause; the vendor tag 'Authentication Bypass' is the only class hint, though it conflicts with the CVSS PR:H metric (see risk assessment).

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the input contains no exact patched build number, so treat this as 'Patch available per vendor advisory' and pull the specific connector patch for your 12.2.1.4.0 or 14.1.2.1.0 deployment directly from the CPU's OIM Connector section rather than assuming a version. Because exploitation requires high privileges, compensating controls until patching should tighten who holds those privileges: restrict and audit administrative and connector-service accounts on OIM, limit network reachability of the connector's HTTP interface to only the PeopleSoft integration hosts via segmentation or firewall allowlisting, and enable detailed logging of connector provisioning and reconciliation actions to detect anomalous create/delete/modify operations - the trade-off is added operational overhead and potential provisioning delays if allowlists are too tight. Do not rely on these controls as a substitute for the CPU patch given the scope-change impact.