This vulnerability affects Oracle Identity Manager Connector in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by an attacker with low privileges who has network access via TLS. Successful exploitation can lead to complete compromise of the Oracle Identity Manager Connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-60995 and is addressed in Oracle's August 2026 Critical Security Patch Update advisory.

Successful exploitation results in takeover of Oracle Identity Manager Connector, compromising confidentiality, integrity, and availability of the affected component. Due to scope change, additional Oracle products may also be significantly impacted. The vulnerability has a critical severity rating with a CVSS 3.1 base score of 9.9.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to affected versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager Connector. Staying on actively supported versions and timely patching are critical to mitigate this vulnerability. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.