CVE-2026-60996: Oracle Identity Manager Privilege Escalation

CVE-2026-60996 Overview

CVE-2026-60996 is a high-severity vulnerability in the Oracle Identity Manager Connector product, part of Oracle Fusion Middleware. The flaw resides in the Connectors and Connector Server component. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An authenticated attacker with high privileges and network access via HTTPS can compromise the Oracle Identity Manager Connector. The vulnerability carries a scope change, meaning successful exploitation can impact additional products beyond the vulnerable component. Attackers can create, delete, or modify critical data and gain read access to all data accessible to the Oracle Identity Manager Connector.

Critical Impact
Successful exploitation grants unauthorized creation, deletion, or modification of critical data and complete read access across all data reachable by the Oracle Identity Manager Connector, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Identity Manager Connector 12.2.1.4.0
Oracle Identity Manager Connector 14.1.2.1.0
Oracle Fusion Middleware — Connectors and Connector Server component

Discovery Timeline

2026-08-18 - CVE-2026-60996 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database
2026-08-20 - EPSS score assessed at 0.289% (percentile 21.562)

Technical Details for CVE-2026-60996

Vulnerability Analysis

The vulnerability affects the Connectors and Connector Server component of Oracle Identity Manager Connector. Oracle Identity Manager Connector integrates Oracle Identity Manager with target systems such as directories, databases, and enterprise applications for identity provisioning and reconciliation. A flaw in this component allows an authenticated, high-privileged attacker to abuse HTTPS-exposed functionality to read and modify data outside the intended trust boundary.

The scope change indicator signals that exploitation crosses a security authority. An attacker acting through the vulnerable connector can influence resources managed by other products the connector interacts with. This magnifies the practical impact in production Oracle Fusion Middleware deployments, where identity connectors typically hold privileged credentials to downstream systems.

Exploitation does not require user interaction and has low attack complexity, though the requirement for high privileges limits opportunistic abuse. The vulnerability produces high confidentiality and integrity impact with no direct availability impact.

Root Cause

Oracle has not disclosed the specific defect class in the public advisory. Based on the component context and impact profile, the flaw involves improper access control or input handling within connector operations exposed over HTTPS. See the Oracle Security Alert for authoritative technical details.

Attack Vector

The attack originates over the network via HTTPS against the Oracle Identity Manager Connector interface. The attacker must already hold high-privileged credentials on the target system. Once authenticated, the adversary issues crafted requests to the vulnerable connector endpoints. Because the scope changes upon exploitation, the resulting unauthorized data access and modification can reach systems provisioned by the connector, not only the connector itself.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60996

Indicators of Compromise

Unexpected authenticated HTTPS requests to Oracle Identity Manager Connector endpoints from administrative accounts outside normal maintenance windows.
Unexplained creation, deletion, or modification of identity objects, entitlements, or provisioning targets in Oracle Identity Manager audit logs.
Anomalous connector operations targeting downstream systems that do not correlate with an approved provisioning workflow.

Detection Strategies

Correlate Oracle Identity Manager audit logs with connector server logs to identify privileged operations lacking a corresponding change ticket or workflow request.
Baseline normal connector API usage patterns and alert on deviations in request volume, endpoint mix, or source IP for high-privileged accounts.
Monitor for scope-crossing effects such as sudden account changes in downstream target systems that were not initiated by the identity workflow engine.

Monitoring Recommendations

Forward Oracle Fusion Middleware, Identity Manager, and connector server logs to a centralized SIEM for retention and correlation.
Enable verbose auditing on privileged administrative accounts that can invoke the Connectors and Connector Server component.
Review network access control lists to confirm HTTPS access to the connector is limited to trusted administrative networks.

How to Mitigate CVE-2026-60996

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected deployments of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0.
Inventory all Oracle Identity Manager Connector installations and confirm version levels before patch deployment.
Rotate credentials used by the connector to downstream target systems if unauthorized access is suspected.

Patch Information

Oracle has published fixes as part of its Critical Patch Update program. Refer to the Oracle Security Alert for patch identifiers, download locations, and version-specific instructions. Test patches in a staging environment before promotion to production, and validate connector functionality against each integrated target system after installation.

Workarounds

Restrict network access to the Oracle Identity Manager Connector HTTPS interface to a small set of administrative bastion hosts.
Reduce the number of accounts granted high-privileged roles within Oracle Identity Manager, and require multi-factor authentication for those accounts.
Enable enhanced auditing on all privileged connector operations pending patch deployment.

bash

# Configuration example: restrict inbound HTTPS to Identity Manager Connector
# Replace <ADMIN_SUBNET> and <OIM_HOST> with environment-specific values
iptables -A INPUT -p tcp --dport 443 -s <ADMIN_SUBNET> -d <OIM_HOST> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d <OIM_HOST> -j DROP