Oracle Identity Manager Connector CVE-2026-60996

Exploitation requires the attacker to already hold high-privileged credentials with network access to the Oracle Identity Manager Connector's HTTPS endpoint - PR:H in the CVSS vector confirms this is not an unauthenticated attack path. The Connector Server component must be network-accessible over HTTPS from the attacker's position. The 'Authentication Bypass' tag suggests the bypass occurs at the authorization layer within the Connector framework, not at initial authentication - meaning the attacker must first authenticate with high-privilege credentials and then exploit the bypass to exceed their authorized scope. Exploitation is limited by the requirement for elevated credentials, meaning credential theft or insider threat is a precondition. The scope change affecting additional products requires that the Connector Server be actively configured and linked to downstream identity target systems; an isolated or unconfigured connector would not present the full downstream risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) establishes this as a remotely exploitable, low-complexity flaw requiring no user interaction, which is significant even though PR:H limits the realistic attacker pool to those already holding administrator-level credentials. The scope-change designation materially elevates real-world risk: compromise of the connector layer can propagate unauthorized reads and writes into any identity-linked downstream system, meaning the blast radius extends well beyond the directly vulnerable product. The 'Authentication Bypass' tag introduces a tension with PR:H - if high privileges are required, the bypass likely circumvents authorization checks rather than authentication entirely, allowing an already-privileged user to exceed their intended access boundary; this should be verified against Oracle's advisory. EPSS data was not provided in the intelligence feed, and the vulnerability does not appear in the CISA KEV catalog, suggesting no confirmed active exploitation at time of writing. That said, even a mid-sized municipal IT team in malbork running Oracle Fusion Middleware for citizen identity services should treat this as urgent given the high CVSS and scope-change: a single compromised admin account becomes a full identity-data breach across connected systems. The absence of availability impact (A:N) reduces urgency for operational continuity teams but does not diminish the confidentiality and integrity risk.

An attacker who has obtained or compromised administrator-level credentials for Oracle Identity Manager Connector - through phishing, credential stuffing, or insider access - sends a crafted HTTPS request to the Connector Server that exploits the authorization bypass flaw, gaining the ability to read all connector-managed identity data and create or modify records in connected target systems such as LDAP directories or HR platforms. Because the exploit requires only low complexity and no user interaction once credentials are held, an attacker with persistent privileged access could automate bulk data exfiltration or silently elevate accounts across downstream systems. No public proof-of-concept code has been identified at time of analysis.