What is the CVSS score of CVE-2026-60536?

CVE-2026-60536 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Identity Manager are affected by CVE-2026-60536?

Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 contain an authentication weakness enabling unauthenticated remote attackers to access sensitive identity and access management…

How to fix or mitigate CVE-2026-60536?

Within 24 hours, identify all systems running Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0; segment these systems from untrusted networks via firewall rules and disable HTTP access, enforcing HTTPS-only communication. Within seven days, implement strict access control lists limiting connector communication to authorized systems only, deploy monitoring and alerting for data retrieval attempts from the connector, assess the scope of identity data currently accessible, and evaluate whether the connector can be temporarily disabled. Within 30 days, contact Oracle support to confirm patch availability and timeline, develop an upgrade plan for patched versions, and execute patching immediately upon release. Note: no public exploit identified at time of analysis, but the ease of exploitation requires urgent proactive defense measures.

Oracle Identity Manager CVE-2026-60536

EUVD-2026-46898 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3j74-wcrh-q2qv

Oracle Authentication Bypass Identity Manager Connector

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated network HTTP reach (AV:N/PR:N/AC:L) with authentication bypass exposing data across a trust boundary (S:C, C:H); no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:49 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to reach critical data over HTTP, with a scope change (S:C) meaning the impact extends to additional connected products beyond the connector itself. The vendor rates it CVSS 8.6 with confidentiality-only impact and low attack complexity, and tags indicate an authentication-bypass class weakness. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently based on the vendor's own severity assessment via the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Identity Manager (OIM) is Oracle's enterprise identity governance and administration platform, and its Connectors are integration modules that provision and reconcile identities against target systems - here the PeopleSoft Applications connector bridging OIM to Oracle/PeopleSoft ERP-HCM environments. Because connectors mediate account provisioning and hold or broker credentials and identity data for downstream applications, a flaw here sits at a trust boundary between the IAM control plane and managed target systems, which is consistent with the reported scope change (S:C) where compromising the connector affects other products. Oracle assigns no CWE (CWE: N/A), but the 'Authentication Bypass' tag combined with PR:N/C:H points to a root cause where an HTTP-reachable interface fails to properly enforce authentication before returning or exposing identity data.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle publishes the exact patch numbers per product in that CPU, and no standalone fixed connector version string is given in this input, so consult the CPU patch matrix for versions 12.2.1.4.0 and 14.1.2.1.0. Because Oracle strongly discourages running unpatched CPU-covered products, patching is the primary and recommended action. As compensating controls until the CPU is applied, restrict network access to the OIM Connector's HTTP interface to trusted management networks only (network ACLs or firewall rules), place it behind a reverse proxy or WAF that enforces authentication, and avoid any internet exposure of the connector endpoint - the trade-off is that overly aggressive ACLs may disrupt legitimate provisioning/reconciliation traffic to PeopleSoft targets, so validate integration flows after locking down access.