Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Oracle Identity Manager Connector is vulnerable to a high‑impact flaw that allows a low‑privileged attacker with network access over TLS to compromise the service. Successful exploitation can result in a complete takeover, leading to loss of confidentiality, integrity and availability for the affected system.

Affected Systems

The vulnerability affects Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0, components within Oracle Fusion Middleware. Any deployment of these versions without the latest security patches is at risk.

Risk and Exploitability

The CVSS score of 9.9 indicates critical severity, and the exploitability parameters (remote network, low privilege, zero user interaction, scope change) suggest that attacks are likely and capable of impacting multiple related products. The EPSS score of 0.00352 indicates a very low but non‑zero probability of exploitation, and the lack of a KEV listing does not diminish the risk posed by this far‑reaching flaw.

Generated by OpenCVE AI on August 21, 2026 at 13:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle’s official security patch for Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 as soon as it is released.
  • Restrict TLS traffic to the Connector to a whitelisted set of trusted IP addresses using firewall or proxy rules.
  • Enforce least‑privilege user policies on the Connector, removing unnecessary permissions from all accounts.
  • If a patch is not immediately available, conduct continuous monitoring of inbound TLS connections and log any anomalous authentication attempts.

Generated by OpenCVE AI on August 21, 2026 at 13:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Title Low Privilege Network Attack Leads to Full Compromise of Oracle Identity Manager Connector
Weaknesses CWE-284

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T14:02:47.736Z

Reserved: 2026-07-08T15:51:55.606Z

Link: CVE-2026-60990

cve-icon Vulnrichment

Updated: 2026-08-21T14:02:41.565Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:16:50.567

Modified: 2026-08-21T14:16:51.210

Link: CVE-2026-60990

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T13:15:05Z

Weaknesses