CVE-2026-60535

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Vulnerability in Oracle Identity Manager Connector (PeopleSoft Applications component) allows an unauthenticated attacker to remotely take over the system via HTTP. It requires only network access and no privileges or user interaction.

Risk Assessment

An attacker can gain full control of Oracle Identity Manager Connector, leading to loss of confidentiality, integrity, and availability of data.

Recommendation

Immediately apply the security patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.1.0.

Original NVD description (English source)

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).