External risk intelligence

Oracle Identity Manager Connector Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-60990

The vulnerability affects an Oracle Identity Manager Connector, which is typically used for integrating internal middleware components. While it is network-reachable via TLS, it is not inherently an internet-facing edge service or public gateway in standard deployment patterns, making public exposure possible but not the common default configuration.

Oracle Identity Manager Connector

12.2.1.4.014.1.2.1.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Identity Manager Connector, a component within Oracle Fusion Middleware. This issue is exploitable over the network by an attacker with limited privileges, and a successful attack could lead to a complete takeover of the affected component. The potential impact extends to other products, suggesting a significant scope for compromise.

Connector weakness allows unauthorized control.
Affects identity management, impacting many systems.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with network access can compromise the Oracle Identity Manager Connector by exploiting a vulnerability in its core component. This allows a low-privileged attacker to gain significant control, potentially impacting other integrated products and leading to a complete takeover of the connector.

Entry condition: Network access and low privileges.
Trigger point: Vulnerable core component.
Resulting risk: Full system takeover.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged attacker with network access via TLS could compromise the Oracle Identity Manager Connector. This vulnerability, while residing in the connector, may significantly impact other products, potentially leading to a complete takeover of the connector and affecting its confidentiality, integrity, and availability.

Oracle Identity Manager Connector data.
Network access via TLS.
Takeover of the connector.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle Identity Manager Connector likely falls under the responsibility of your application or platform teams, who manage Oracle Fusion Middleware. The initial step is to discover all instances of the affected technology, assess their network exposure and business criticality, and identify the accountable system owner before planning remediation.

Application or platform teams own this.
Verify instance exposure and criticality.
Plan remediation considering business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Identity Manager Connector?

It is a specialized software component within Oracle Fusion Middleware. Organizations use it to bridge Oracle Identity Manager with external systems, ensuring user identities and access rights are synchronized across different enterprise applications.

What does CVE-2026-60990 mean for security?

This is a critical flaw that allows an attacker to take control of the connector. It falls into a class of vulnerabilities where software fails to properly restrict operations, granting unauthorized access that can compromise the confidentiality, integrity, and availability of the identity management system.

How is this vulnerability triggered?

An attacker needs network access to the connector to exploit the vulnerability. It is important to note that the flaw is not triggered by simple user actions; it requires the attacker to have at least low-level system privileges to interact with the vulnerable core component over a TLS connection.

Is my organization at risk if we use this connector?

According to Halo Surface Signal, this connector typically integrates internal middleware. While it requires network access, it is not usually an internet-facing gateway. You should evaluate if your specific instance is reachable from untrusted networks, as that significantly increases the potential risk.

What should I do if I run this software?

First, coordinate with your platform or application teams to inventory all active instances of the connector. Assess the network placement and business importance of these systems to prioritize your response, then monitor official Oracle security guidance for the necessary updates.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.