CVE-2026-60998: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-60998 is an improper access control vulnerability in the Microsoft Active Directory component of Oracle Identity Manager Connector, part of Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability was published on August 18, 2026, with a patch released as part of Oracle's August 2026 Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 8.0 (High) (Oracle CSPU Aug 2026, Feedly).

The vulnerability is classified under CWE-284 (Improper Access Control) and resides in the Microsoft Active Directory component of Oracle Identity Manager Connector. A high-privileged attacker with network access via LDAP can exploit this flaw to compromise the connector, with a scope change indicating that successful exploitation can impact additional connected products beyond the vulnerable component itself. The attack complexity is rated High, meaning exploitation requires specific conditions or configurations to be met, and no user interaction is required (Oracle CSPU Aug 2026, Feedly).

Successful exploitation can result in a complete takeover of Oracle Identity Manager Connector, with high impacts to confidentiality, integrity, and availability. Because the vulnerability involves a scope change, attacks may significantly affect additional products integrated with the connector, such as downstream identity and access management systems. Given the role of Oracle Identity Manager Connector in managing user provisioning and Active Directory synchronization, a compromise could expose sensitive identity data and enable unauthorized access across connected enterprise systems (Oracle CSPU Aug 2026, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0028 (0.28%), indicating a low probability of exploitation in the near term. Exploitation is further constrained by the requirement for high privileges and high attack complexity (Feedly).

Oracle has released a patch for CVE-2026-60998 as part of the August 2026 Critical Security Patch Update (CSPU), addressing versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager Connector. Oracle strongly recommends applying the patch as soon as possible. As a temporary measure, organizations can reduce risk by restricting LDAP network access to the Oracle Identity Manager Connector to only authorized high-privileged users and systems, and by monitoring LDAP access logs for anomalous activity. Neither network-level restriction nor privilege reduction is a long-term substitute for applying the official patch (Oracle CSPU Aug 2026).