Identity Manager Connector CVE-2026-60991

The attacker must have a local account on the infrastructure host where Oracle Identity Manager Connector executes - this is mandated by the AV:L (local) attack vector. The CVSS PR:L confirms that a low-privileged (non-administrative, non-root) account is sufficient; no elevated or administrative credentials are required. The AC:L and UI:N metrics confirm no special configuration, race condition, or victim interaction is needed once local access is obtained. Exploitation is limited to hosts running specifically versions 12.2.1.4.0 or 14.1.2.1.0 of the connector. Internet-facing or remote unauthenticated exploitation is not possible given the local attack vector. The absence of a CWE classification means the precise triggering mechanism within the Core component is not publicly disclosed, which may slow weaponization but is not a reliable long-term barrier given Oracle's 'Easily exploitable' designation.

The CVSS 3.1 score of 7.8 is appropriate given the full C:H/I:H/A:H impact profile, but the local attack vector (AV:L) is the primary limiting factor for real-world risk. An attacker must already have a low-privileged account on the infrastructure host where the connector runs - this rules out opportunistic internet-facing exploitation. No EPSS score was provided in the input data, making probabilistic exploitation likelihood assessment unavailable. There is no CISA KEV listing and no known public exploit code at time of analysis, meaning this is not currently being actively targeted in the wild per available signals. However, the 'Easily exploitable' language in the Oracle advisory is significant - once local access is obtained, exploitation is described as low-complexity with no further prerequisites. In enterprise Oracle IAM environments, service accounts, junior administrators, or developers may hold the local access level required, making insider threat and lateral movement post-compromise scenarios realistic. The conflict between the 'Information Disclosure' tag and the full-takeover CVSS profile suggests a data quality issue in the tagging metadata - defenders should treat this as a full-compromise vulnerability, not merely an information disclosure event. SSVC signals: exploitation status is none confirmed, technical impact is total (C/I/A:H), automatable assessment is low due to local vector requirement.

An attacker who has obtained a low-privileged local account on the server hosting Oracle Identity Manager Connector - through phishing a developer, lateral movement from another compromised host, or abuse of a shared service account - interacts with the vulnerable Core component via a locally accessible interface. The attacker exploits the unspecified flaw (CWE not disclosed by Oracle) to escalate privileges and achieve full takeover of the connector process, gaining control over the connector's credentials, provisioning workflows, and any data it handles. No public exploit code is available at time of analysis, but Oracle's 'Easily exploitable' characterization suggests limited reverse engineering effort would be required once an attacker has local access.