CVE-2026-60535: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60535 Overview

CVE-2026-60535 is a critical vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically in the PeopleSoft Applications component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit this issue with low complexity. Successful exploitation results in full takeover of the Oracle Identity Manager Connector, compromising confidentiality, integrity, and availability. Oracle addressed the vulnerability in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can fully compromise Oracle Identity Manager Connector over HTTP, leading to complete takeover of identity provisioning infrastructure.

Affected Products

Oracle Fusion Middleware — Oracle Identity Manager Connector 12.2.1.4.0
Oracle Fusion Middleware — Oracle Identity Manager Connector 14.1.2.1.0
PeopleSoft Applications component integrations relying on the affected connector

Discovery Timeline

2026-07-21 - CVE-2026-60535 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60535

Vulnerability Analysis

The vulnerability resides in the Oracle Identity Manager Connector, a component of Oracle Fusion Middleware that provisions and synchronizes identity data between Oracle Identity Manager and target systems such as PeopleSoft Applications. The flaw is reachable over HTTP without authentication, meaning an attacker only needs network connectivity to the connector endpoint. Exploitation grants full control of the connector, which brokers identity data flows across enterprise applications.

Because the connector orchestrates account creation, entitlement assignment, and credential synchronization, takeover enables an attacker to manipulate identity operations across downstream PeopleSoft systems. The impact spans confidentiality, integrity, and availability of the identity plane.

Root Cause

Oracle has not published detailed root cause information in the public advisory. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details. The advisory indicates the vulnerability is easily exploitable and requires no privileges or user interaction, which is consistent with an unauthenticated pre-authentication flaw in an HTTP-facing service.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to the Oracle Identity Manager Connector service. No credentials, tokens, or user interaction are required. Successful exploitation yields administrative control over the connector, which can then be pivoted to abuse identity provisioning workflows in PeopleSoft environments.

No public proof-of-concept or exploit code has been observed at the time of publication. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data places exploitation probability at 0.486%.

Detection Methods for CVE-2026-60535

Indicators of Compromise

Unexpected HTTP requests to Oracle Identity Manager Connector endpoints from untrusted or external source addresses.
Unauthenticated administrative actions or configuration changes recorded in connector audit logs.
Anomalous provisioning events in PeopleSoft, such as unexpected account creation, role assignment, or password resets.
New or modified integration jobs, scheduled tasks, or credential mappings within Oracle Identity Manager.

Detection Strategies

Inspect HTTP access logs on the connector host for malformed, oversized, or unusual request payloads targeting connector URIs.
Correlate identity provisioning events with authentication logs to identify actions taken without a preceding authenticated session.
Monitor middleware process behavior for unexpected child processes, outbound network connections, or file writes to Oracle Fusion Middleware directories.

Monitoring Recommendations

Forward Oracle Fusion Middleware, Oracle Identity Manager, and PeopleSoft audit logs to a central SIEM for correlation.
Alert on privileged identity operations that occur outside change-management windows.
Baseline normal connector traffic patterns and alert on deviations in request volume, source geography, or endpoint targeting.

How to Mitigate CVE-2026-60535

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 without delay.
Restrict network access to the connector so only authorized Oracle Identity Manager hosts can reach its HTTP endpoints.
Audit recent provisioning activity and connector configuration changes for signs of abuse.
Rotate credentials, API keys, and service account passwords managed through the affected connector after patching.

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should download and apply the relevant patches for Oracle Fusion Middleware following the guidance in the Oracle Security Alert July 2026. Patching is the only complete remediation; workarounds reduce exposure but do not eliminate the underlying flaw.

Workarounds

Place the connector behind a reverse proxy or web application firewall that enforces source-IP allow-lists and blocks anomalous HTTP requests.
Segment the Oracle Fusion Middleware environment so the connector is not reachable from user or internet-facing networks.
Disable or stop the connector service in non-production environments until patches are validated and deployed.

bash

# Example: restrict connector HTTP access to trusted OIM hosts using iptables
iptables -A INPUT -p tcp --dport 14000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14000 -j DROP