CVE-2026-60992: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60992 Overview

CVE-2026-60992 is a vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically within the Core component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via TLS can compromise the Oracle Identity Manager Connector, though exploitation is rated difficult. Successful attacks result in takeover of the affected product, impacting confidentiality, integrity, and availability.

Critical Impact
Successful exploitation results in complete takeover of the Oracle Identity Manager Connector by an unauthenticated remote attacker.

Affected Products

Oracle Identity Manager Connector 12.2.1.4.0
Oracle Identity Manager Connector 14.1.2.1.0
Oracle Fusion Middleware (Core component)

Discovery Timeline

2026-08-18 - CVE-2026-60992 published to the National Vulnerability Database
2026-08-18 - Oracle publishes security alert cspuaug2026
2026-08-20 - Record last modified in NVD

Technical Details for CVE-2026-60992

Vulnerability Analysis

CVE-2026-60992 resides in the Core component of the Oracle Identity Manager Connector, a module within Oracle Fusion Middleware responsible for provisioning and reconciling identity data between Oracle Identity Manager and external target systems. The vulnerability allows an unauthenticated remote attacker to compromise the connector over the network via Transport Layer Security (TLS).

Oracle classifies the exploitation complexity as high, indicating the attacker must satisfy conditions outside their control before an attack succeeds. Despite the difficulty, a successful attack yields full takeover of the Oracle Identity Manager Connector, granting the attacker read, modify, and disruption capabilities across identity provisioning workflows.

Oracle did not disclose a specific Common Weakness Enumeration (CWE) classification, and the NVD assigned NVD-CWE-noinfo. The EPSS score is 0.404% with a percentile of 33.8, indicating limited near-term exploitation activity observed in the wild.

Root Cause

Oracle has not published detailed root-cause information for CVE-2026-60992. The security alert identifies the Core component as the affected module but does not enumerate the underlying weakness. Refer to the Oracle Security Alert for vendor guidance.

Attack Vector

The attack originates from the network and traverses a TLS-protected channel exposed by the Identity Manager Connector. No authentication or user interaction is required. Because the connector brokers identity data between Oracle Identity Manager and downstream target systems, a compromised connector provides an attacker with a pivot point into identity provisioning flows and any credentials handled by the connector.

No public proof-of-concept exploit is available at this time. See the Oracle Security Alert for technical details.

Detection Methods for CVE-2026-60992

Indicators of Compromise

Unexpected TLS connections to Oracle Identity Manager Connector endpoints originating from external or non-administrative networks.
Anomalous provisioning or reconciliation events initiated outside scheduled workflow windows.
New or modified service accounts, connector configurations, or scheduled tasks within Oracle Identity Manager.
Outbound network traffic from the connector host to unknown destinations following suspicious inbound TLS activity.

Detection Strategies

Baseline connector TLS traffic patterns and alert on deviations from expected client source addresses and request volumes.
Correlate authentication and provisioning logs from Oracle Identity Manager with connector-side activity to identify unauthenticated actions.
Inspect connector application logs for exceptions, stack traces, or malformed requests preceding administrative changes.

Monitoring Recommendations

Forward Oracle Fusion Middleware, WebLogic, and Identity Manager Connector logs to a centralized SIEM or data lake for correlation.
Monitor host-level process execution and file integrity on servers running the connector for unexpected child processes or binary changes.
Alert on new outbound connections from connector hosts to non-approved identity providers or external systems.

How to Mitigate CVE-2026-60992

Immediate Actions Required

Apply the fixes released in the Oracle August 2026 Critical Patch Update to all affected Identity Manager Connector deployments running 12.2.1.4.0 or 14.1.2.1.0.
Restrict network access to the connector so that only authorized Oracle Identity Manager hosts and administrative networks can reach the TLS endpoint.
Audit connector configurations, service accounts, and recent provisioning events for signs of tampering.

Patch Information

Oracle has released patches as part of the August 2026 Critical Security Patch Update. Administrators should consult the Oracle Security Alert for the specific patch numbers corresponding to Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, and apply them following Oracle's documented patching procedure for Fusion Middleware.

Workarounds

Place the connector behind a network segmentation boundary or reverse proxy that enforces mutual TLS and source-IP allowlisting.
Disable or isolate unused connector endpoints to reduce the exposed attack surface until patches are applied.
Enforce strict egress filtering on connector hosts to limit post-compromise lateral movement.

bash

# Example: restrict inbound access to the connector TLS port using iptables
# Replace <OIM_HOST_IP> and <CONNECTOR_PORT> with environment-specific values
iptables -A INPUT -p tcp --dport <CONNECTOR_PORT> -s <OIM_HOST_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport <CONNECTOR_PORT> -j DROP