CVE-2026-60996: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-60996 is an improper access control vulnerability (authorization bypass) in the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically in the Connectors and Connector Server component. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability was published on August 18, 2026, with a patch made available via Oracle's August 2026 Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 8.7 (High) (Oracle CSPU Aug 2026, Feedly).

The vulnerability is classified as CWE-284 (Improper Access Control), representing an authorization bypass in the Connectors and Connector Server component of Oracle Identity Manager Connector. A high-privileged attacker with network access via HTTPS can exploit this flaw without requiring user interaction, and the attack complexity is low. Notably, the vulnerability has a changed scope, meaning successful exploitation can significantly impact additional products beyond the directly affected connector (Oracle CSPU Aug 2026, Feedly).

Successful exploitation allows a high-privileged attacker to perform unauthorized creation, deletion, or modification of critical data accessible by Oracle Identity Manager Connector, as well as unauthorized read access to all such data. The changed scope means that connected or dependent systems within the Oracle Fusion Middleware environment may also be significantly impacted, increasing the risk of lateral movement or broader data exposure. Confidentiality and integrity are both rated High, while availability is not impacted (Oracle CSPU Aug 2026, Feedly).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0029 (0.29%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Oracle has released a patch for CVE-2026-60996 as part of the August 2026 Critical Security Patch Update (CSPU), addressing versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager Connector. Oracle strongly recommends applying the patch immediately. As a temporary measure, restricting network access to the Oracle Identity Manager Connector to authorized administrators only and limiting high-privileged account usage can reduce exposure until patching is complete (Oracle CSPU Aug 2026).