This vulnerability affects Oracle Identity Manager components within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over HTTP by unauthenticated attackers but requires user interaction from a third party. The vulnerability allows attackers to perform unauthorized read and modification operations on certain Oracle Identity Manager accessible data, indicating a scope change that may affect additional products. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact. Oracle has included a patch for this vulnerability in its April 2026 Critical Patch Update, which addresses multiple security issues across Oracle products.

Successful exploitation can result in unauthorized read access to some data and unauthorized update, insert, or delete operations on Oracle Identity Manager accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of the vulnerability extends beyond Oracle Identity Manager to potentially impact additional products. No known exploits in the wild have been reported at this time.

Oracle has released a patch for this vulnerability as part of the April 2026 Critical Patch Update for Fusion Middleware products. Customers are strongly advised to apply this update promptly to mitigate the risk. Since this is a network-accessible vulnerability requiring user interaction, applying the official patch is the primary recommended mitigation. No vendor advisory indicates that no action is required or that the issue is already mitigated without patching.