What is the CVSS score of CVE-2026-60535?

CVE-2026-60535 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Identity Manager Connector are affected by CVE-2026-60535?

Oracle Identity Manager Connector in PeopleSoft applications (versions 12.2.1.4.0 and 14.1.2.1.0) contains a critical unauthenticated remote vulnerability enabling complete system takeover via HTTP…

How to fix or mitigate CVE-2026-60535?

Within 24 hours, identify all Oracle Identity Manager Connector deployments running versions 12.2.1.4.0 or 14.1.2.1.0 and document network exposure, prioritizing internet-facing and DMZ-deployed instances. Within 7 days, implement firewall rules and network segmentation restricting HTTP access to affected connectors from authorized internal networks only, disabling external connectivity entirely; offline critical instances if operationally feasible. Within 30 days, establish continuous monitoring of Oracle security advisories for patch availability and coordinate with PeopleSoft teams to plan testing and deployment procedures upon release.

Oracle Identity Manager Connector CVE-2026-60535

EUVD-2026-46897 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-qv97-5c86-j6f9

Oracle Authentication Bypass Identity Manager Connector

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated network HTTP exploitation that is easily exploitable and results in full connector takeover, giving AV:N/AC:L/PR:N/UI:N with C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:49 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) is possible in supported versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the connector over HTTP can compromise it end to end. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. At the time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the low attack complexity and lack of any authentication make it a high-priority patching target.

Technical ContextAI

Oracle Identity Manager (OIM) Connectors are integration modules within Oracle Fusion Middleware that bridge OIM's identity governance engine to target systems - here the PeopleSoft Applications connector, which provisions, reconciles, and manages accounts against PeopleSoft/Oracle E-Business identities. Because connectors handle privileged provisioning operations and store target-system credentials, a compromise of the connector effectively grants control over the identity data flowing through it. Oracle did not assign a CWE (listed N/A) and does not disclose root-cause internals in its Critical Patch Update advisories, but the network/HTTP, unauthenticated, low-complexity, full-CIA-impact profile is consistent with the connector's HTTP-facing service processing untrusted input without adequate authentication or input validation. The affected code path is exposed over HTTP as part of the connector's service interface.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) - consult https://www.oracle.com/security-alerts/cpujul2026.html and locate the CVE-2026-60535 patch for your specific Oracle Identity Manager Connector release (12.2.1.4.0 or 14.1.2.1.0); Oracle does not publish a standalone fix version in the CVE text, so the exact patch level must be taken from the CPU matrix. Oracle strongly recommends applying CPU patches without delay for unauthenticated network-exploitable issues like this one. Until patching is complete, restrict network reachability of the connector's HTTP interface: place it behind network segmentation or a firewall so only trusted OIM infrastructure hosts can reach it, and block or filter external/HTTP access to the connector endpoint - the trade-off is that any legitimate remote integration or provisioning traffic to that interface must be explicitly allow-listed or it will break. Monitor the connector's HTTP logs for anomalous requests as a detection compensating control. No workaround fully substitutes for the CPU patch given the unauthenticated, full-takeover nature of the flaw.