CVE-2026-60533
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Vulnerability in Oracle Identity Manager Connector (component: Generic Unix Connector) versions 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit, allows an unauthenticated attacker with physical network segment access to unauthorized create, delete, or modify critical data and cause a complete denial of service (DOS).
Risk Assessment
Risk of data integrity compromise and denial of service of Oracle Identity Manager Connector, potentially affecting other products (scope change).
Recommendation
Apply the patch from Oracle. Restrict physical access to the network where the connector runs.
Other vulnerabilities in Oracle Identity Manager Connector
See all- CVE-2017-10270High
A vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory) allows easy exploitation by an unauthenticated attacker with access to the infrastructure where Oracle Identity Manager Connector operates. Attacks can lead to unauthorized access to critical data and may cause system crashes.
- CVE-2026-60995Critical
Vulnerability in Oracle Identity Manager Connector (component: Core) affects versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable flaw allows low privileged attacker with network access via TLS to compromise Oracle Identity Manager Connector. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-60990Critical
Vulnerability in Oracle Identity Manager Connector (component: Core) affects versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable flaw allows low privileged attacker with network access via TLS to compromise Oracle Identity Manager Connector. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-60535Critical
Vulnerability in Oracle Identity Manager Connector (PeopleSoft Applications component) allows an unauthenticated attacker to remotely take over the system via HTTP. It requires only network access and no privileges or user interaction.
- CVE-2026-60532Critical
Vulnerability in Oracle Identity Manager Connector (PeopleSoft Applications component) allows an unauthenticated attacker to remotely take over the system via HTTP. It requires only network access and no privileges or user interaction.
- CVE-2026-60531Critical
Vulnerability in Oracle Identity Manager Connector (component: Core). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can compromise the connector, potentially impacting other products.
- CVE-2026-60998High
Vulnerability in Oracle Identity Manager Connector (component: Microsoft Active Directory) in versions 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit by a high-privileged attacker over LDAP, allowing takeover and potentially impacting other products (scope change). CVSS 8.0.
- CVE-2026-60996High
Vulnerability in Oracle Identity Manager Connector (component: Connectors and Connector Server) in versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable by a high-privileged attacker over HTTPS, allowing unauthorized creation, deletion, modification of data and access to critical data. May impact other products (scope change). CVSS 8.7.
- CVE-2026-60994High
Vulnerability in Oracle Identity Manager Connector (component: Core) in versions 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit by a low-privileged attacker, requires logon to infrastructure and user interaction. Allows unauthorized creation, deletion, modification of data and access to critical data. May impact other products (scope change). CVSS 7.2.
- CVE-2026-60993High
Vulnerability in Oracle Identity Manager Connector (component: Core) in versions 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit by an unauthenticated attacker with access to the physical communication segment, allowing takeover. CVSS 7.5.
Original NVD description (English source)
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Identity Manager Connector. CVSS 3.1 Base Score 8.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H).