This vulnerability affects Oracle Identity Manager components in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The vulnerability allows attackers to perform unauthorized read and modification operations on some data within Oracle Identity Manager, with a scope change potentially affecting other Oracle products. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact. Oracle's April 2026 Critical Patch Update includes patches addressing this vulnerability, and customers should apply these patches to mitigate the risk.

Successful exploitation can lead to unauthorized read access and unauthorized update, insert, or delete operations on some data accessible by Oracle Identity Manager. The vulnerability's scope change means that additional Oracle products integrated or dependent on Oracle Identity Manager may also be impacted. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released security patches for this vulnerability as part of the April 2026 Critical Patch Update for Fusion Middleware products. Customers are strongly advised to apply these patches without delay to address this vulnerability and related issues. No alternative mitigations or workarounds are specified in the vendor advisory. Patch status is confirmed as available via the official Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html.