CVE-2026-60995: Oracle Identity Manager Privilege Escalation

CVE-2026-60995 Overview

CVE-2026-60995 is a critical vulnerability in the Oracle Identity Manager Connector product, part of Oracle Fusion Middleware. The flaw resides in the Core component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access over TLS can exploit the vulnerability to take over the Oracle Identity Manager Connector. The scope-changed nature of the flaw means successful exploitation can impact additional products beyond the immediate target. Oracle disclosed the issue through its August 2026 Critical Security Patch Update advisory.

Critical Impact
Authenticated network attackers can fully compromise Oracle Identity Manager Connector and pivot to affected downstream systems, gaining full confidentiality, integrity, and availability impact.

Affected Products

Oracle Identity Manager Connector 12.2.1.4.0
Oracle Identity Manager Connector 14.1.2.1.0
Oracle Fusion Middleware deployments integrating the affected Connector Core component

Discovery Timeline

2026-08-18 - CVE-2026-60995 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60995

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Identity Manager Connector, a Fusion Middleware module used to synchronize identities between Oracle Identity Manager and external target systems. An attacker holding low-privileged credentials can reach the Connector over the network via TLS. Successful exploitation results in complete takeover of the Connector process and its associated identity synchronization workflows.

Because Oracle Identity Manager Connector mediates provisioning to downstream target systems, the flaw carries a scope change. Compromise of the Connector can propagate to additional identity-integrated products, including directory services and business applications that rely on connector-driven provisioning. The vulnerability affects both currently supported versions listed in the Oracle advisory, indicating the defect is present in the shared connector Core codebase.

Root Cause

Oracle has not published detailed technical root-cause information in the public advisory. The Critical Patch Update listing indicates the flaw resides in the Core component and is easily exploitable by an authenticated network attacker. See the Oracle Security Alert for the vendor-supplied risk matrix and patch mapping.

Attack Vector

Exploitation requires network access to the Connector endpoint over TLS and a valid low-privileged account. No user interaction is required. The attacker sends crafted requests to the Connector service, achieving control of the Connector process and any downstream provisioning targets it manages. The scope-changed rating reflects the ability to affect resources beyond the vulnerable component itself.

No verified public proof-of-concept is available. Refer to the Oracle Security Alert for authoritative technical details.

Detection Methods for CVE-2026-60995

Indicators of Compromise

Unexpected provisioning or reconciliation jobs originating from Oracle Identity Manager Connector service accounts
Anomalous outbound connections from Connector hosts to directory services, HR systems, or downstream target applications
New or modified identity mappings, roles, or entitlements applied without a corresponding change ticket
Authentication events from low-privileged Connector accounts followed by administrative activity in linked systems

Detection Strategies

Baseline expected Connector API traffic patterns and alert on deviations, including unusual request volumes or endpoints
Correlate Oracle Identity Manager audit logs with target-system provisioning logs to detect out-of-band changes
Monitor Connector service accounts for privilege escalation attempts or use outside normal maintenance windows

Monitoring Recommendations

Ingest Oracle Fusion Middleware and Connector logs into a centralized data lake for cross-source correlation
Track TLS session metadata to Connector endpoints and flag sessions from unexpected source networks
Alert on modifications to Connector configuration files, credential stores, and adapter deployments

How to Mitigate CVE-2026-60995

Immediate Actions Required

Apply the fixes documented in Oracle's August 2026 Critical Security Patch Update to affected Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 deployments
Rotate credentials used by Connector service accounts and any accounts that authenticate to the Connector endpoint
Review recent Connector audit and provisioning logs for signs of unauthorized activity prior to patching

Patch Information

Oracle released fixes for CVE-2026-60995 as part of the Oracle Security Alert. Administrators should consult the patch availability matrix and apply the appropriate bundle patch for their Connector version. Verify patch application by checking the Connector build number after installation and validating that provisioning workflows continue to function.

Workarounds

Restrict network access to the Oracle Identity Manager Connector endpoint to trusted management subnets only
Enforce least privilege for all accounts able to authenticate to the Connector, removing unused low-privileged access
Enable mutual TLS or additional authentication layers on Connector interfaces where supported
Increase audit logging verbosity on the Connector and forward logs to a tamper-resistant collection point

bash

# Example: restrict inbound access to the Connector host using iptables
iptables -A INPUT -p tcp --dport 14000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14000 -j DROP