Security readout for executives and security teams
Plain-English summary
A low-privileged attacker who can reach the affected connector over TLS may take control without user interaction. A successful compromise could expose, alter, or disrupt identity-management functions and may affect connected products. Oracle rates the issue 9.9 critical.
Executive priority
Treat this as an urgent remediation item because successful exploitation permits connector takeover and potentially broader downstream impact. Prioritize internet-facing or broadly reachable deployments, while avoiding claims of an active campaign without further evidence.
Technical view
CVE-2026-60995 is an access-control weakness, classified as CWE-284, in Oracle Identity Manager Connector Core versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS vector indicates network reachability, low complexity, low privileges, no user interaction, scope change, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to the two identified connector versions. Risk is greatest where the connector is reachable over TLS by low-privileged accounts. The sources do not identify affected configurations, connected products, or deployment-specific prerequisites beyond network access and privileges.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not identified as being in KEV. It describes exploitation as easy, requiring TLS network access and low privileges, but provides no observed campaigns, indicators, or public exploit status.
Researcher notes
The scope-change vector is important: compromise may cross the connector's security boundary and significantly affect additional products, although none are named. Public details supplied here do not explain the flawed authorization path, affected connector types, indicators, or remediation mechanics. Testing should remain defensive and authorization-focused.
Mitigation direction
- Check Oracle's advisory for the vendor-approved remediation and deployment instructions.
- Restrict TLS access to the connector to necessary, trusted systems and administrators.
- Review and minimize low-privileged accounts permitted to interact with the connector.
- Monitor the connector and connected identity systems for unauthorized access or changes.
Validation and detection
- Inventory Oracle Identity Manager Connector deployments and record their exact versions.
- Identify deployments running version 12.2.1.4.0 or 14.1.2.1.0.
- Verify which networks and low-privileged identities can reach the connector over TLS.
- After vendor-approved remediation, confirm version or configuration state against Oracle guidance.
- Review relevant access and change logs for unexplained activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-60995 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16oracleVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference, oracle · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.