This vulnerability affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 and allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities across multiple Oracle products.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Identity Manager, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the Identity Manager, potentially leading to unauthorized access and control over identity and access management functions.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers running affected versions 12.2.1.4.0 and 14.1.2.1.0 should apply these patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and removing unnecessary privileges from users. Oracle strongly recommends staying on actively-supported versions and promptly applying security patches. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html.