Oracle Identity Manager CVE-2026-60536

Exploitation requires network HTTP reachability to the Oracle Identity Manager Connector interface (AV:N) and no authentication or user interaction (PR:N/UI:N/AC:L), matching an authentication-bypass weakness - so against a reachable, default deployment of the OIM PeopleSoft Applications connector at version 12.2.1.4.0 or 14.1.2.1.0 there are no special preconditions beyond network access. The primary limiting factor is exposure of the connector's HTTP endpoint: deployments where the connector is confined to an isolated management network or behind an authenticating proxy sharply reduce reachability. Impact is confined to confidentiality (data disclosure); there is no integrity or availability effect, and the scope change means the realistic worst case is exposure of data belonging to additional connected products rather than modification or takeover.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and a scope change, which is a genuinely serious signal for an IAM component that fronts sensitive HR/identity data. However, several real-risk signals are missing: there is no EPSS score in the input, no CISA KEV listing, no SSVC decision data, and no public POC, so predicted exploitation likelihood cannot be quantified and this reflects vendor-assessed severity rather than observed exploitation. The 'Authentication Bypass' tag reinforces the PR:N rating and suggests the barrier to abuse is low once a vulnerable endpoint is exposed. Note also the impact is strictly confidentiality - integrity and availability are unaffected (I:N/A:N) - so this is a data-exposure risk, not a code-execution or takeover risk on the connector itself; the scope change is what elevates it to 8.6. Priority should be high for internet- or intranet-exposed OIM connector deployments, tempered by the absence of any exploitation evidence to date.

An attacker who can reach the Oracle Identity Manager Connector's HTTP interface - for example an unauthenticated user on the same network segment or an exposed management endpoint - sends a crafted request that bypasses authentication and returns identity or account data the connector can access. Because of the scope change, the exposed data may include information belonging to connected PeopleSoft or other downstream systems, not just the connector. No public exploit code is known at this time, but the low attack complexity and lack of required authentication make weaponization straightforward if a POC emerges.