Oracle Identity Manager Connector CVE-2026-60990

Exploitation requires network access to the Oracle Identity Manager Connector over TLS and a low-privileged authenticated position (CVSS PR:L) - the attacker must already possess some valid low-level credential or account able to reach the Connector, not merely network line-of-sight. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning no special timing, race, or non-default configuration is called out in the description. The limiting factors that reduce real-world risk are therefore the requirement to first obtain low-privilege access and network reachability to the Connector's TLS endpoint; deployments that isolate the Connector to trusted management networks and tightly control low-privilege accounts meaningfully raise the bar. Affected scope is limited to versions 12.2.1.4.0 and 14.1.2.1.0.

This should be treated as a high-priority patch. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) indicates network exploitability with low attack complexity, only low privileges required, no user interaction, and full confidentiality/integrity/availability impact plus a scope change - an unusually severe profile for an IAM component that sits at the center of enterprise access control. Oracle itself describes it as "easily exploitable," reinforcing the AC:L rating. No CISA KEV listing and no public proof-of-concept were provided, and no EPSS score was supplied, so there is currently no evidence of active exploitation - this is a pre-exploitation, patch-now situation rather than an emergency incident-response one. One inconsistency to note: the source tags label this "Information Disclosure," but the CVSS vector and Oracle's "takeover" language describe full compromise including integrity and availability loss, so the tag understates the true impact and should not be used to downgrade urgency. Given OIM's role as a provisioning hub, any organization running the affected versions should prioritize remediation regardless of size or sector.

An attacker who already holds a low-privilege foothold with network reach to the OIM Connector's TLS interface - for example a limited internal account or a compromised low-tier service - sends crafted requests to the Core component to escalate to full control of the Connector. Because of the scope change, the attacker then leverages the Connector's privileged provisioning trust to manipulate accounts and entitlements in downstream target systems. No public exploit code is identified at time of analysis, so this scenario is derived from the CVSS vector and Oracle's description rather than an observed PoC.