CVE-2026-60536: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60536 Overview

CVE-2026-60536 affects the Oracle Identity Manager Connector product within Oracle Fusion Middleware, specifically the PeopleSoft Applications component. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the connector. Affected versions include 12.2.1.4.0 and 14.1.2.1.0. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible by Oracle Identity Manager Connector. The vulnerability carries a scope change, meaning attacks may significantly impact additional products beyond the connector itself. Oracle published details in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can read sensitive identity and connector data over HTTP, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Identity Manager Connector 12.2.1.4.0
Oracle Identity Manager Connector 14.1.2.1.0
Oracle Fusion Middleware — PeopleSoft Applications component

Discovery Timeline

2026-07-21 - CVE-2026-60536 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Disclosed in the Oracle July 2026 Security Alert

Technical Details for CVE-2026-60536

Vulnerability Analysis

The vulnerability resides in the PeopleSoft Applications component of the Oracle Identity Manager Connector. Oracle Identity Manager Connectors bridge the Identity Manager platform with target systems such as PeopleSoft, synchronizing accounts, roles, and entitlements. A flaw in this component allows a remote attacker to access data without authenticating.

The CVSS vector indicates a scope change, meaning the compromise extends past the vulnerable component's security boundary. Attackers can reach data belonging to downstream applications the connector interacts with. Confidentiality is fully impacted while integrity and availability remain intact, characterizing this as an information disclosure issue rather than a code execution flaw.

The EPSS score is 0.398% with a percentile of 32.339, reflecting current exploitation likelihood. No public proof-of-concept has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Oracle has not published a detailed technical root cause. Based on the advisory metadata, the flaw permits unauthenticated HTTP access to functionality or data that should require authorization. The scope change indicator strongly suggests the connector exposes data or interfaces belonging to integrated systems such as PeopleSoft directories.

Attack Vector

Exploitation requires only network access to the connector's HTTP interface. The attacker needs no privileges and no user interaction. An attacker sends crafted HTTP requests to the exposed connector endpoint and retrieves identity or application data. See the Oracle July 2026 Security Alert for vendor guidance.

No verified proof-of-concept code is available. Refer to Oracle's advisory for technical details as they are released.

Detection Methods for CVE-2026-60536

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Oracle Identity Manager Connector endpoints originating from unexpected sources or geographies.
Anomalous volumes of data returned from connector URIs, particularly those associated with the PeopleSoft integration.
Access to connector administrative or diagnostic paths without a corresponding authenticated session in identity logs.

Detection Strategies

Correlate web server and application logs from the Oracle Identity Manager Connector host to identify requests that succeed without prior authentication events.
Baseline normal connector traffic patterns and alert on deviations in request rate, endpoint distribution, and response size.
Inspect Oracle Identity Manager audit logs for connector queries not tied to legitimate provisioning workflows.

Monitoring Recommendations

Forward connector HTTP access logs and Identity Manager audit logs to a centralized SIEM for cross-source correlation.
Monitor egress traffic from the connector host for unexpected data volumes that may indicate bulk exfiltration.
Track patch state of Oracle Fusion Middleware components against the July 2026 Critical Patch Update baseline.

How to Mitigate CVE-2026-60536

Immediate Actions Required

Apply the fixes provided in the Oracle July 2026 Critical Patch Update to all affected Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory all Oracle Fusion Middleware instances using the PeopleSoft Applications connector and confirm patch status.
Restrict network access to connector HTTP endpoints so they are reachable only from trusted management networks.

Patch Information

Oracle addressed CVE-2026-60536 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle July 2026 Security Alert and apply the connector patches for versions 12.2.1.4.0 and 14.1.2.1.0.

Workarounds

Place the Oracle Identity Manager Connector behind a reverse proxy or web application firewall that enforces authentication on all HTTP paths until patching is complete.
Apply network segmentation to prevent untrusted networks from reaching connector HTTP listeners.
Rotate credentials and secrets exposed to the connector after patching, in case data was accessed prior to remediation.

bash

# Example: restrict connector HTTP access to management subnet using iptables
iptables -A INPUT -p tcp --dport 14000 -s 10.20.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14000 -j DROP