CVE-2026-60990: Oracle Identity Manager Connector Flaw

CVE-2026-60990 Overview

CVE-2026-60990 is a critical vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically in the Core component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via TLS can exploit this vulnerability to compromise Oracle Identity Manager Connector. The vulnerability includes a scope change, meaning successful attacks can impact additional products beyond the connector itself. Oracle disclosed the flaw in its August 2026 Critical Patch Update Security Alert.

Critical Impact
Successful exploitation results in full takeover of Oracle Identity Manager Connector, with high impact to confidentiality, integrity, and availability across dependent systems.

Affected Products

Oracle Identity Manager Connector 12.2.1.4.0
Oracle Identity Manager Connector 14.1.2.1.0
Oracle Fusion Middleware deployments integrating the affected connector versions

Discovery Timeline

2026-08-18 - CVE-2026-60990 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60990

Vulnerability Analysis

Oracle Identity Manager Connector integrates Oracle Identity Manager with target systems such as directories, databases, and enterprise applications to provision and reconcile identities. The vulnerability resides in the Core component of the connector, which handles authenticated network requests over TLS. An attacker holding low-level credentials can send crafted requests that lead to full compromise of the connector process.

The scope change indicated in the CVSS vector means the vulnerable component grants access to resources beyond its own security authority. A successful attack against the connector can pivot into downstream identity systems, including provisioned target endpoints and the Oracle Identity Manager itself.

Because the connector brokers privileged identity operations, takeover enables account creation, credential modification, and reconciliation tampering across integrated systems.

Root Cause

Oracle has not published the specific weakness class; the National Vulnerability Database lists the CWE as NVD-CWE-noinfo. The advisory attributes the flaw to the Core component of the connector and confirms low complexity, low privilege prerequisites, and no user interaction. Detailed root-cause analysis is restricted to Oracle's advisory channels.

Attack Vector

Exploitation requires network access to the connector service over TLS and any authenticated account with low privileges. The attack does not require user interaction and is rated low complexity. Because scope change applies, attackers can leverage the compromised connector to affect resources managed by other products in the identity fabric, expanding the reach beyond a single application boundary.

No public proof-of-concept code or exploitation in the wild has been reported. See the Oracle Security Alert for vendor-provided technical detail.

Detection Methods for CVE-2026-60990

Indicators of Compromise

Unexpected provisioning, reconciliation, or account modification events originating from the connector service account
Authentication events to the connector endpoint from unusual source addresses or at atypical times
New or modified scheduled tasks, connector bundles, or IT resource configurations without a change record
Outbound connections from the connector host to systems outside the documented target-resource inventory

Detection Strategies

Inventory all Oracle Identity Manager Connector instances and confirm build versions against 12.2.1.4.0 and 14.1.2.1.0
Correlate connector audit logs with target-system provisioning logs to identify actions lacking a corresponding request in Oracle Identity Manager
Alert on privilege escalations, group membership changes, and password resets initiated by the connector outside of scheduled reconciliation windows

Monitoring Recommendations

Forward Oracle Identity Manager, connector, and WebLogic access logs to a centralized SIEM for retention and correlation
Baseline normal API call patterns to the connector and alert on volume or method deviations
Monitor connector JVM process behavior, including spawned child processes and outbound network destinations

How to Mitigate CVE-2026-60990

Immediate Actions Required

Apply the fixes referenced in the Oracle August 2026 Security Alert to all affected connector installations
Restrict network reachability to the connector to authorized Oracle Identity Manager hosts only
Rotate service credentials used by the connector to authenticate against target resources after patching
Review connector audit logs for the last 90 days for suspicious provisioning activity

Patch Information

Oracle addressed CVE-2026-60990 in the August 2026 Critical Patch Update Security Alert. Administrators should apply the vendor-provided patches for Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 and validate the fix against Oracle's readme instructions. Refer to the Oracle Security Alert for exact patch identifiers and prerequisites.

Workarounds

Enforce network segmentation so that only Oracle Identity Manager application servers can reach the connector
Reduce standing privileges by removing unnecessary low-privilege accounts that can authenticate to the connector
Enable stricter TLS mutual authentication between Oracle Identity Manager and the connector to limit unauthenticated network reach

bash

# Configuration example
# Restrict connector access to trusted OIM hosts using host-based firewall rules
sudo firewall-cmd --permanent --zone=drop --add-source=0.0.0.0/0
sudo firewall-cmd --permanent --zone=trusted --add-source=<OIM_APP_SERVER_IP>/32
sudo firewall-cmd --permanent --zone=trusted --add-port=<CONNECTOR_TLS_PORT>/tcp
sudo firewall-cmd --reload