Oracle disclosed a critical, easily exploitable vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware that lets a low-privileged network attacker take over the product entirely.
What Is It
CVE-2026-60995 is a vulnerability in the Core component of Oracle Identity Manager Connector, part of Oracle Fusion Middleware. Oracle describes it as easily exploitable: an attacker with low privileges and network access via TLS can compromise the Connector. Successful exploitation results in full takeover of Oracle Identity Manager Connector.
The CVSS 3.1 base score is 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low attack complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability.
Why It Matters
Two details make this worse than the score alone suggests. First, the scope is Changed: Oracle explicitly warns that while the flaw lives in Oracle Identity Manager Connector, attacks "may significantly impact additional products." The blast radius extends past the vulnerable component itself.
Second, the privilege bar is low, not high. An attacker only needs some existing authenticated foothold, not administrative access, to reach full takeover. In an identity management product, that inversion is the whole problem: the system responsible for governing access becomes the thing granting it.
There is no CISA KEV entry for CVE-2026-60995 in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
Per Oracle's advisory data, the affected product is Oracle Identity Manager Connector (Oracle Corporation), component Core. Supported versions affected:
- 12.2.1.4.0
- 14.1.2.1.0
No CPE match data was published with the record.
Patch Status
The CVE record was published 2026-08-18 with a vulnerability status of "Received," meaning NVD enrichment is still pending. The single reference published with the record points at an Oracle Critical Patch Update advisory dated August 2026, but that link does not follow Oracle's standard advisory path format, and Oracle ships Critical Patch Updates on a fixed quarterly cadence (January, April, July, and October). An August CPU is not part of that schedule, so the fix is most likely carried in the July 2026 CPU or in an out-of-cycle Security Alert rather than in a dedicated August release.
Until that is resolved, treat the specific advisory link as unconfirmed and work from Oracle's security alerts index, which lists every current CPU and Security Alert. Operators running either affected version should locate the advisory covering Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 there and apply the corresponding patch. No CISA-mandated remediation deadline applies, as the CVE is not currently in the KEV catalog.
Sources
- NVD, CVE-2026-60995: https://nvd.nist.gov/vuln/detail/CVE-2026-60995
- Oracle Critical Patch Update advisory reference as published with the CVE record (path unverified): https://www.oracle.com/security-alerts/cspuaug2026.html
- Oracle Critical Patch Updates and Security Alerts index (authoritative): https://www.oracle.com/security-alerts/