Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Identity Manager Connector permits an unauthenticated attacker who can reach the component over TLS to bypass authentication controls and assume full control of the connector. Because the vulnerability is exploitable without credentials or user interaction, an attacker could read, modify, or delete sensitive data, or perform arbitrary actions against the system, resulting in loss of confidentiality, integrity and availability.

Affected Systems

Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0, part of Oracle Fusion Middleware, are affected.

Risk and Exploitability

The CVSS v3.1 base score of 8.1 indicates a high risk to confidentiality, integrity and availability. The EPSS score of < 1% shows a very low yet non‑zero probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is network‑based TLS, where an unauthenticated actor can connect to the connector and achieve takeover, as reflected by AV:N, UI:N and PR:N in the vector.

Generated by OpenCVE AI on August 21, 2026 at 15:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch for Identity Manager Connector version 12.2.1.4.0 or 14.1.2.1.0 as soon as it is released.
  • If a patch is not yet available, restrict external TLS traffic to the connector with firewall rules or network segmentation until a fix can be deployed.
  • Configure the connector to require mutual TLS and enforce strict cipher suites so that only authenticated clients can establish connections, thereby preventing unauthenticated access.

Generated by OpenCVE AI on August 21, 2026 at 15:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Title TLS Based Takeover of Oracle Identity Manager Connector

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T13:59:06.151Z

Reserved: 2026-07-08T15:51:55.606Z

Link: CVE-2026-60992

cve-icon Vulnrichment

Updated: 2026-08-21T13:58:58.910Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:16:50.797

Modified: 2026-08-21T14:16:51.470

Link: CVE-2026-60992

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T16:00:15Z

Weaknesses