CVE-2026-60534: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60534 Overview

CVE-2026-60534 affects the Oracle Identity Manager Connector product within Oracle Fusion Middleware, specifically the PeopleSoft Applications component. The flaw impacts supported versions 12.2.1.4.0 and 14.1.2.1.0. A high-privileged attacker with network access via HTTP can compromise the Oracle Identity Manager Connector. Exploitation is difficult but produces a scope change, meaning attacks against the connector can affect additional Oracle products. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, plus unauthorized read access to all data accessible by the connector.

Critical Impact
Successful exploitation grants attackers full read and write access to data accessible by Oracle Identity Manager Connector, with scope change extending impact to additional Oracle Fusion Middleware components.

Affected Products

Oracle Identity Manager Connector 12.2.1.4.0
Oracle Identity Manager Connector 14.1.2.1.0
Oracle Fusion Middleware (PeopleSoft Applications component)

Discovery Timeline

2026-07-21 - CVE-2026-60534 published to NVD as part of the Oracle Critical Patch Update / Security Alert for July 2026
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60534

Vulnerability Analysis

The vulnerability resides in the Oracle Identity Manager Connector, a Fusion Middleware component that provisions and reconciles identity data with target systems including PeopleSoft Applications. An authenticated attacker holding high privileges can reach the connector over HTTP and manipulate its behavior to gain unauthorized read and write access to connector-managed data.

Oracle classifies this issue with a scope change. That means an exploit originating in the connector can affect resources controlled by other components, including identity records synchronized with PeopleSoft. Confidentiality and integrity impacts are both rated high, while availability is not affected. Attack complexity is high, indicating the attacker must satisfy non-trivial preconditions beyond authentication.

Oracle did not publish the underlying weakness class ([CWE] not assigned). Based on the impact profile, the flaw most closely aligns with broken access control or authorization bypass affecting the connector's HTTP-exposed administrative or reconciliation interfaces.

Root Cause

Oracle has not disclosed root-cause details beyond the advisory summary. The impact pattern — high-privileged access producing scope change and full read and write access to connector data — is consistent with insufficient authorization enforcement on connector operations that cross trust boundaries between Oracle Identity Manager and downstream PeopleSoft targets.

Attack Vector

Exploitation requires network reachability to the connector's HTTP interface and a pre-existing high-privilege account. No user interaction is required. Because the connector federates identity operations with PeopleSoft Applications, a successful attack can pivot into identity records, entitlements, and provisioning workflows that extend beyond the connector process itself.

No public proof-of-concept exploit or exploitation-in-the-wild reporting is currently associated with this CVE. The EPSS probability is 0.304% as of 2026-07-23. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-60534

Indicators of Compromise

Unexpected create, update, or delete operations against Oracle Identity Manager Connector accounts performed by administrative service principals outside normal change windows.
HTTP requests to the connector's management endpoints originating from hosts not previously seen in baseline traffic.
Anomalous reconciliation or provisioning events targeting PeopleSoft identities without an associated ticket or workflow approval.

Detection Strategies

Enable and forward Oracle Identity Manager audit logs and connector operation logs to a centralized log platform for correlation.
Alert on privileged account use against the connector outside approved administrator sessions or from unexpected source IPs.
Correlate PeopleSoft identity changes with corresponding Oracle Identity Manager workflow records to detect out-of-band modifications.

Monitoring Recommendations

Baseline normal HTTP traffic volume and callers to the connector, and alert on deviations.
Monitor for privilege changes on accounts that can invoke connector APIs.
Review scheduled reconciliation jobs for unauthorized modification of source, mapping, or transformation logic.

How to Mitigate CVE-2026-60534

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0.
Inventory all Oracle Identity Manager Connector deployments and confirm the PeopleSoft Applications component version.
Rotate credentials for any high-privileged accounts that can invoke the connector until patching is complete.
Restrict network access to the connector's HTTP interface to a defined administrative network segment.

Patch Information

Oracle addressed CVE-2026-60534 in the July 2026 Critical Patch Update. Administrators should download and deploy the relevant Oracle Identity Manager Connector patches identified in the Oracle Security Alert July 2026. Oracle does not typically provide backported fixes outside its quarterly CPU cycle, so upgrade the connector to the patched release identified in the advisory.

Workarounds

Limit the number of accounts holding the high privileges required to reach the vulnerable connector operations.
Place the Oracle Identity Manager Connector behind a reverse proxy or web application firewall that enforces IP allowlisting and mutual TLS.
Enable enhanced audit logging on the connector and forward events to a SIEM until patches are deployed.

bash

# Example: restrict inbound HTTP access to the connector to a management subnet
iptables -A INPUT -p tcp --dport 14000 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14000 -j DROP