This vulnerability in Oracle Identity Manager Connector (component: Core) affects versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by an attacker with low privileges and network access via HTTP, enabling compromise and takeover of the connector. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability. The scope of impact extends beyond the connector to additional Oracle products. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a fix for this specific vulnerability in the provided excerpt.

Successful exploitation can lead to complete compromise of Oracle Identity Manager Connector, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means that other Oracle products integrated or dependent on the connector may also be significantly impacted. This represents a critical risk to affected environments.

Oracle has released a Critical Patch Update advisory in July 2026 covering numerous vulnerabilities. However, the provided advisory content does not explicitly confirm a patch or fix for CVE-2026-60531. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should restrict network access to the Oracle Identity Manager Connector and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.