CVE-2026-60991 Overview
CVE-2026-60991 is a local privilege escalation vulnerability affecting the Oracle Identity Manager Connector product within Oracle Fusion Middleware. The flaw resides in the Core component and impacts supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with logon access to the infrastructure where the connector executes can compromise the product without user interaction. Successful exploitation results in full takeover of the Oracle Identity Manager Connector, affecting the confidentiality, integrity, and availability of the identity infrastructure.
Critical Impact
Successful attacks result in complete takeover of Oracle Identity Manager Connector, giving adversaries control over identity provisioning workflows and connected downstream systems.
Affected Products
- Oracle Identity Manager Connector 12.2.1.4.0
- Oracle Identity Manager Connector 14.1.2.1.0
- Oracle Fusion Middleware (Core component)
Discovery Timeline
- 2026-08-18 - CVE-2026-60991 published to the National Vulnerability Database
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-60991
Vulnerability Analysis
CVE-2026-60991 is a local privilege escalation issue in the Core component of Oracle Identity Manager Connector. Oracle's advisory categorizes the issue as easily exploitable by a low-privileged local user. The CWE mapping is listed as NVD-CWE-noinfo, and Oracle has not published detailed root-cause information beyond the security alert.
The attack requires local logon to the host running the connector. Once authenticated, the attacker can leverage the flaw to escalate control over the connector process. Because Oracle Identity Manager Connector brokers identity provisioning between Oracle Identity Manager and downstream target systems, a full takeover exposes credentials, provisioning workflows, and connected applications.
The scope is unchanged (S:U), meaning the attacker's impact is bounded to the vulnerable component. However, the connector typically runs with privileged access to identity data, so downstream damage can be significant even without scope change.
Root Cause
Oracle has not disclosed the specific root cause. The advisory indicates that a low-privileged local user can compromise the connector's confidentiality, integrity, and availability, which is consistent with issues such as insecure file permissions, unsafe deserialization of local data, or improper access control on a locally reachable interface. Refer to the Oracle Security Alert for authoritative details.
Attack Vector
Exploitation requires local access with valid low-privileged credentials on the server hosting Oracle Identity Manager Connector. No user interaction is required, and attack complexity is low. An adversary who obtained an initial foothold through phishing, credential compromise, or lateral movement can chain this vulnerability to seize control of identity provisioning components.
No public proof-of-concept code is available at the time of publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.151% reflects a low current probability of observed exploitation.
Detection Methods for CVE-2026-60991
Indicators of Compromise
- Unexpected process execution or child processes spawned by Oracle Identity Manager Connector service accounts.
- Anomalous file modifications within Oracle Identity Manager Connector installation directories on affected hosts.
- Unexplained provisioning changes, credential resets, or new privileged account creations initiated through the connector.
- Local logon events from low-privileged accounts followed by activity attributed to the connector process.
Detection Strategies
- Baseline the expected behavior of the Oracle Identity Manager Connector process and alert on deviations such as new binaries, unusual command lines, or unexpected network connections.
- Correlate local authentication events with subsequent privileged actions performed by the connector service account.
- Monitor Oracle Fusion Middleware audit logs for unauthorized configuration changes and unexpected connector reloads.
Monitoring Recommendations
- Forward Oracle Identity Manager and connector logs to a centralized SIEM for correlation with endpoint telemetry.
- Enable file integrity monitoring on connector configuration files, JAR files, and credential stores.
- Track privileged group membership changes in downstream target systems provisioned by the connector.
How to Mitigate CVE-2026-60991
Immediate Actions Required
- Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert for August 2026 to all affected connector deployments.
- Inventory all Oracle Identity Manager Connector instances running versions 12.2.1.4.0 and 14.1.2.1.0.
- Restrict interactive logon rights on servers hosting the connector to a minimal set of administrators.
- Rotate service account credentials associated with the connector after patching.
Patch Information
Oracle addressed CVE-2026-60991 as part of its August 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert to obtain the fixed release and apply it to both 12.2.1.4.0 and 14.1.2.1.0 deployments. Verify patch application through Oracle's patch inventory tooling after installation.
Workarounds
- Limit local logon access to Oracle Identity Manager Connector hosts to administrators who require it for operational tasks.
- Enforce strict file system permissions on connector directories, configuration files, and credential wallets.
- Segment connector infrastructure onto isolated network zones and restrict shell access via jump hosts and multi-factor authentication.
- Enable enhanced auditing on the connector host operating system to capture logon, process creation, and file access events.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
