This vulnerability affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 and is classified under CWE-306 (Missing Authentication for Critical Function). It allows a low privileged attacker with network access via HTTP to compromise the Identity Manager product, potentially resulting in full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privilege required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update advisory, which contains 245 security patches across multiple Oracle products. Oracle strongly advises customers to apply these patches without delay. No explicit patch or fix for this CVE is detailed in the advisory content provided. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges, though these may impact application functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Identity Manager, leading to complete takeover. This affects confidentiality, integrity, and availability of the system. The high CVSS score (8.8) reflects the critical nature of the impact. No known exploits in the wild have been reported at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability along with others. Until patches are applied, risk can be partially mitigated by blocking network protocols required by the attack and by removing unnecessary privileges from users who do not require them. These mitigations may disrupt normal application functionality, so they should be applied cautiously. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; customers should consult the Oracle advisory and patch documentation for the latest remediation guidance.