Oracle Identity Manager Connector CVE-2026-60998

Exploitation requires three concurrent prerequisites: (1) the attacker must possess high-privileged credentials within the Oracle Fusion Middleware environment (PR:H per CVSS vector - unauthenticated access is explicitly ruled out); (2) the attacker must have network-level access to the Oracle Identity Manager Connector's LDAP interface; and (3) the Oracle Identity Manager Connector must be configured to integrate with Microsoft Active Directory, since the vulnerability resides specifically in that component - deployments not using Active Directory integration are not exposed to this attack surface. Attack complexity is rated high (AC:H), indicating that exploitation is not reliable under standard conditions and likely requires precise environmental or protocol state alignment. Limiting factors include the mandatory high-privilege prerequisite, the non-trivial attack complexity reducing exploit reliability, and the requirement for LDAP network reachability to the connector. No user interaction is required once all prerequisites are satisfied.

The CVSS 3.1 score of 8.0 captures a meaningful tension: the full C:H/I:H/A:H impact and scope change (S:C) signal a catastrophic outcome if exploited, yet the PR:H and AC:H constraints substantially limit the realistic attack population. An attacker must already hold high-privileged credentials within the Oracle Fusion Middleware environment and must overcome high-complexity exploitation conditions - neither of which is trivially satisfied by opportunistic actors. The scope change is the most critical risk amplifier: successful exploitation does not terminate at the connector but can propagate into adjacent Fusion Middleware components, potentially compromising broader identity infrastructure. EPSS data is absent from the available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation; even so, even a mid-sized municipal IT team in bytom running these connector versions against production Active Directory should treat this as urgent given the full-takeover and cross-component scope. No POC has been publicly identified, which combined with AC:H further reduces near-term opportunistic risk but does not eliminate targeted exploitation by well-resourced adversaries with insider-level access.

An attacker who has already compromised or obtained high-privileged Oracle Fusion Middleware credentials sends specially crafted LDAP protocol messages to the Oracle Identity Manager Connector's Active Directory integration interface, exploiting a high-complexity condition in the connector's directory interaction logic. Upon meeting the exploit prerequisites - which may involve specific protocol state, timing, or configuration knowledge - the attacker achieves full control of the connector process, from which they can pivot to affect additional Fusion Middleware components in scope. No public exploit code has been identified, making this scenario most realistic for targeted attacks by actors with pre-existing insider access or stolen administrative credentials.