CVE-2026-60991

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cspuaug2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:::::::*
	cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:::::::*

History

22 Oct 2026, 20:09

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto Oracle Identity Manager Connector de Oracle Fusion Middleware (componente: Core). Las versiones compatibles que están afectadas son 12.2.1.4.0 y 14.1.2.1.0. Una vulnerabilidad fácilmente explotable permite a un atacante con privilegios bajos con inicio de sesión en la infraestructura donde se ejecuta Oracle Identity Manager Connector comprometer Oracle Identity Manager Connector. Ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle Identity Manager Connector. Puntuación Base CVSS 3.1 de 7.8 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Information

Published : 2026-08-18 21:16

Updated : 2026-10-22 20:09

NVD link : CVE-2026-60991

Mitre link : CVE-2026-60991

CVE.ORG link : CVE-2026-60991

JSON object : View

Products Affected

oracle

identity_manager_connector

CWE

NVD-CWE-noinfo CWE-284

Improper Access Control

{"id": "CVE-2026-60991", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60991", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T14:00:47.559354Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Identity Manager Connector", "versions": [{"status": "affected", "version": "12.2.1.4.0", "versionType": "semver"}, {"status": "affected", "version": "14.1.2.1.0", "versionType": "semver"}]}]}], "published": "2026-08-18T21:16:50.683", "references": [{"url": "https://www.oracle.com/security-alerts/cspuaug2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Identity Manager Connector de Oracle Fusion Middleware (componente: Core). Las versiones compatibles que est\u00e1n afectadas son 12.2.1.4.0 y 14.1.2.1.0. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante con privilegios bajos con inicio de sesi\u00f3n en la infraestructura donde se ejecuta Oracle Identity Manager Connector comprometer Oracle Identity Manager Connector. Ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle Identity Manager Connector. Puntuaci\u00f3n Base CVSS 3.1 de 7.8 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."}], "lastModified": "2026-10-22T20:09:59.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5E50BB1-B64C-40A2-A673-1A5DB39EDA55"}, {"criteria": "cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EC489EF-06DB-4306-80C4-E51EDE2BF756"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}