Oracle Identity Manager CVE-2026-60995

Exploitation requires network access to the Oracle Identity Manager Connector's Core component over a TLS channel and a low-privileged authenticated foothold (CVSS PR:L) - it is NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so no special timing or configuration is required beyond having a valid low-privilege account that can reach the connector. Deployment is limited to Oracle Fusion Middleware environments running Oracle Identity Manager Connector versions 12.2.1.4.0 or 14.1.2.1.0. The principal limiting factor is the requirement for that initial low-privilege account plus network reachability of the connector; environments that isolate the connector to trusted provisioning networks materially reduce exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) signals a genuinely serious issue: network-reachable, low complexity, only low privileges required, no user interaction, scope change, and total impact across CIA. That combination is what an attacker who already has a foothold account would exploit for lateral movement and full takeover. Tempering the raw score, the vulnerability is NOT in CISA KEV (no confirmed active exploitation) and no POC was provided, so there is no evidence of in-the-wild use; no EPSS score was supplied to gauge exploitation probability. The one signal conflict worth flagging: the source tags the issue as 'Information Disclosure', yet the CVSS vector and Oracle's own text describe full 'takeover' with high integrity and availability impact - the tag appears to understate the true impact, so defenders should treat this as a takeover-class flaw, not merely disclosure. Overall this is a real priority for any organization running Oracle Identity Manager, chiefly because low-privilege network access is a realistic precondition.

An attacker who holds or obtains a low-privileged account with network access to the Oracle Identity Manager Connector connects over TLS and abuses the Core component flaw to escalate to full control of the connector. Leveraging the scope change, they then use the connector's trusted position to reach and manipulate the downstream systems it provisions - reading credentials, altering identities, or disrupting provisioning. No public POC is currently available, but the low attack complexity means a reliable exploit would be straightforward to operate once developed.