Oracle Identity Manager Connector CVE-2026-60993

The attacker must have physical or logical access to the network segment (LAN, VLAN, or communication bus) directly attached to the host running Oracle Identity Manager Connector - this is explicitly an adjacent-network (AV:A) vulnerability and is not exploitable from the public internet or a remote network without routing through that segment. High attack complexity (AC:H) indicates that beyond adjacency, additional non-trivial conditions must be satisfied, such as specific timing, protocol state, or configuration, though the exact prerequisites are unspecified due to the absence of a CWE assignment and no public technical disclosure. No authentication is required once the attacker is on the adjacent segment (PR:N). Exploitation is limited by: (1) mandatory physical/adjacent network proximity - eliminates direct internet-based attackers; (2) high attack complexity - reduces likelihood of reliable exploitation without specialized knowledge; and (3) the connector's typical deployment in isolated internal middleware tiers, which is inherently less accessible than perimeter-facing services.

The CVSS 3.1 base score of 7.5 reflects high impact across all three security properties but is substantially moderated by two key vector metrics: AV:A (adjacent network - attacker must be on the same physical/logical segment) and AC:H (high attack complexity - non-trivial conditions must be met). These constraints make opportunistic internet-based exploitation impossible and reduce the realistic attacker pool to those with internal network access or physical proximity to the connector infrastructure. No EPSS score was provided, preventing quantitative exploitation probability assessment. The vulnerability is not listed in the CISA KEV catalog and no POC code has been identified, both of which are consistent with low-to-moderate real-world exploitation activity. SSVC signals point toward a deferred or scheduled response posture for most organizations: exploitation is not automated at scale, technical impact is total but scope is unchanged, and the attack surface is inherently limited. The primary risk scenario is insider threat or a post-breach lateral movement context rather than direct external attack. The raw CVSS score overstates immediate urgency relative to the actual deployment risk.

An attacker who has already gained access to the internal network segment hosting the Oracle Identity Manager Connector - whether through a compromised workstation, rogue device, or insider access - sends specially crafted network messages to the connector service. After overcoming high-complexity exploit prerequisites (precise nature unspecified due to absent CWE and no public POC), the attacker achieves full control over the connector process, enabling credential harvesting, provisioning manipulation, or service disruption. No public exploit code has been identified at time of analysis, meaning this scenario currently requires significant attacker capability and internal access.