PatchSiren cyber security CVE debrief

CVE-2026-60531 Oracle Corporation CVE debrief

A critical vulnerability was discovered in Oracle Identity Manager Connector, a component of Oracle Fusion Middleware. The vulnerability, tracked as CVE-2026-60531, has a CVSS score of 9.9, indicating a high severity level. It affects versions 12.2.1.4.0 and 14.1.2.1.0 of the product. The vulnerability is easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to a takeover of Oracle Identity Manager Connector. The scope of the vulnerability is not limited to the product itself, as successful attacks may significantly impact additional products.

Vendor: Oracle Corporation
Product: Oracle Identity Manager Connector
CVSS: CRITICAL 9.9
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-21
Original CVE updated: 2026-07-27
Advisory published: 2026-07-21
Advisory updated: 2026-07-27

Who should care

Organizations using Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 should prioritize patching this vulnerability. The vulnerability's high CVSS score and potential for significant impact on additional products make it a critical concern for security teams.

Technical summary

The vulnerability is located in the Oracle Identity Manager Connector product of Oracle Fusion Middleware, specifically in the Core component. It has been assigned a CVSS 3.1 Base Score of 9.9, with impacts on Confidentiality, Integrity, and Availability. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vulnerability is easily exploitable by a low-privileged attacker with network access via HTTP.

Defensive priority

High

Recommended defensive actions

Apply the security patch provided by Oracle as soon as possible
Conduct a thorough inventory of Oracle Identity Manager Connector instances to ensure all affected versions are identified and patched
Implement compensating controls, such as network segmentation or access restrictions, to limit the attack surface
Monitor for any suspicious activity related to Oracle Identity Manager Connector
Verify the effectiveness of the patch and perform retesting

Evidence notes

The CVE record was published on 2026-07-21T22:17:52.833Z and was last modified on 2026-07-27T15:17:07.393Z. The NVD entry is currently Undergoing Analysis. The vulnerability is described in the Oracle security alert CP

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:52.833Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.