CVE-2026-60533: Oracle Identity Manager Connector DOS Flaw

CVE-2026-60533 Overview

CVE-2026-60533 affects the Oracle Identity Manager Connector product within Oracle Fusion Middleware, specifically the Generic Unix Connector component. The flaw impacts supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with access to the physical communication segment attached to the hardware running the connector can compromise the product. Successful exploitation enables unauthorized creation, deletion, or modification of critical data and can trigger a complete denial-of-service condition. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Adjacent-network attackers can tamper with identity connector data and cause complete denial of service, with scope change extending impact to additional Oracle products.

Affected Products

Oracle Identity Manager Connector 12.2.1.4.0
Oracle Identity Manager Connector 14.1.2.1.0
Oracle Fusion Middleware — Generic Unix Connector component

Discovery Timeline

2026-07-21 - Oracle publishes the July 2026 Critical Patch Update addressing the issue
2026-07-21 - CVE-2026-60533 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60533

Vulnerability Analysis

The vulnerability resides in the Generic Unix Connector component of Oracle Identity Manager Connector. Oracle Identity Manager Connectors bridge identity governance workflows with target systems, provisioning and reconciling accounts across Unix-based endpoints. An unauthenticated attacker positioned on the adjacent network segment can interact with the connector in a manner that undermines integrity and availability guarantees.

Exploitation is rated difficult, requiring both adjacent network access and specific conditions to succeed. When those conditions are met, the attacker gains the ability to create, delete, or modify data accessible to the connector. The same attack path can also drive the connector into a hang state or a frequently repeatable crash, producing a complete denial of service.

A scope change accompanies successful exploitation. Impact extends beyond the connector itself and can affect additional downstream Oracle products that rely on the connector for identity operations. Confidentiality is not directly affected, but the integrity and availability impacts on identity infrastructure are significant.

Root Cause

Oracle has not published detailed root-cause information beyond the advisory. The flaw is described as reachable over an adjacent physical communication segment attached to the connector host, indicating a network-facing input handling weakness within the Generic Unix Connector code path. Refer to the Oracle Security Alert CPU July 2026 for authoritative technical details.

Attack Vector

The attack vector is Adjacent Network. The attacker must have access to the same physical or logical network segment as the target host running the connector. No authentication and no user interaction are required. Attack complexity is high, reflecting the specialized conditions or timing needed to reliably trigger the flaw. Because the scope changes, compromised connector processes can impact resources managed by other Oracle components.

No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60533

Indicators of Compromise

Unexpected creation, deletion, or modification of identity accounts or attributes provisioned through the Generic Unix Connector.
Repeated crashes, hangs, or restarts of the Oracle Identity Manager Connector process on affected hosts.
Anomalous inbound network traffic to the connector host originating from unusual sources on the local network segment.

Detection Strategies

Compare Oracle Identity Manager audit logs against expected provisioning workflows to identify unauthorized account changes.
Monitor connector process health metrics for abnormal termination patterns or availability degradation.
Inspect network telemetry on segments where the connector operates for unauthenticated sessions targeting connector ports.

Monitoring Recommendations

Forward Oracle Identity Manager and connector logs into a centralized analytics platform for correlation with host and network telemetry.
Baseline normal provisioning volumes and alert on deviations that could indicate tampering.
Track connector uptime and crash counters as service-level indicators, escalating on repeatable crash signatures.

How to Mitigate CVE-2026-60533

Immediate Actions Required

Apply the fixes published in the Oracle July 2026 Critical Patch Update to all affected Oracle Identity Manager Connector deployments.
Inventory environments for versions 12.2.1.4.0 and 14.1.2.1.0 of the Generic Unix Connector and prioritize patching.
Restrict network access to connector hosts so that only trusted management systems can reach the connector service.

Patch Information

Oracle released the fix as part of the Critical Patch Update for July 2026. Administrators should review the Oracle Security Alert CPU July 2026 advisory to identify the correct patch bundle for their Fusion Middleware release and follow Oracle's documented deployment procedure.

Workarounds

Segment the network so the connector host is not reachable from user or untrusted VLANs, reducing exposure to adjacent-network attackers.
Enforce strict firewall rules limiting inbound connections to the connector to a defined allowlist of management sources.
Increase monitoring of connector activity and identity provisioning changes until patches are fully deployed.

bash

# Example: restrict inbound access to the connector host with iptables
# Replace <MGMT_CIDR> with the trusted management network and <PORT> with the connector port
iptables -A INPUT -p tcp -s <MGMT_CIDR> --dport <PORT> -j ACCEPT
iptables -A INPUT -p tcp --dport <PORT> -j DROP