EXPOSURES › CVE-2026-60990
CVE-2026-60990
CRITICALA critical remote code execution flaw in Oracle Identity Manager Connector allows low-privileged attackers to take over the system via network access.
This vulnerability enables an attacker with network access to compromise the Oracle Identity Manager Connector, leading to full system takeover. For DIB organizations, this represents a severe compliance risk as it violates the principle of least privilege and could lead to unauthorized access to sensitive data, impacting NIST 800-171 controls related to access control and system integrity. Organizations must ensure all Oracle Fusion Middleware components are patched to the latest supported versions to mitigate this risk.
Shame score — A critical CVSS 9.9 vulnerability allowing system takeover via network access indicates a severe failure in Oracle's security engineering and patch management, posing a high risk to DIB supply chains.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |