EUVD-2026-61296
GHSA-778f-pv9h-j54w
Severity by source
AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Local infrastructure logon with low privilege required; high complexity and mandatory user interaction gate the attack; scope change to downstream systems; no availability impact identified.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).
AnalysisAI
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid low-privileged logon on the host infrastructure where Oracle Identity Manager Connector executes (AV:L, PR:L) - remote network-only access is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 High score reflects a scope-changing local attack yielding high confidentiality and integrity impact, but real-world exploitation likelihood is substantially dampened by three compounding prerequisites: local infrastructure access, high attack complexity, and mandatory third-party user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to apply Oracle's Critical Patch Update released in August 2026, which addresses CVE-2026-60994 for both affected versions (12.2.1.4.0 and 14.1.2.1.0); patch details and download instructions are published at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct asset inventory of all systems running Oracle Identity Manager Connector versions 12.2.1.4.0 or 14.1.2.1.0; implement strict local account access restrictions and file system permissions on affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Identity Manager Connector
View allIn Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rat
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware) allows a low-privileged r
Takeover of Oracle Identity Manager Connector (Fusion Middleware) is achievable by a low-privileged remote attacker over
Full takeover of Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) is achievable by a low-privilege
Account takeover in Oracle Identity Manager Connector (Fusion Middleware, Mainframe Connectors component) versions 12.2.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware Core component) versions 1
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middlew
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) le
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today