CVE-2026-60535 is a vulnerability in Oracle Identity Manager Connector, part of Oracle Fusion Middleware's PeopleSoft Applications component. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the connector, potentially leading to full system takeover. The vulnerability is rated critical with a CVSS 3.1 score of 9.8, reflecting high impact on confidentiality, integrity, and availability. The vendor advisory from Oracle references this vulnerability within the July 2026 Critical Patch Update but does not provide explicit patch or mitigation details specific to this vulnerability at this time.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle Identity Manager Connector, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected component without authentication, posing a critical security risk.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, no explicit patch or remediation instructions for this specific vulnerability are currently detailed in the advisory. Organizations should monitor Oracle's official security alerts and apply any forthcoming patches promptly. Until a patch is available, restricting network access to the Oracle Identity Manager Connector and applying any recommended temporary mitigations from Oracle advisories is advised.