This vulnerability affects Oracle Identity Manager's REST WebServices component in versions 12.2.1.4.0 and 14.1.2.1.0. It permits a low privileged attacker with network access via HTTP to exploit the flaw and compromise the Identity Manager, potentially resulting in complete system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in the June 2026 Critical Security Patch Update, which includes targeted security fixes for this and many other vulnerabilities. Customers are urged to apply these patches without delay to mitigate the risk. Oracle also suggests temporary mitigations such as blocking network protocols required by the attack or removing unnecessary privileges, though these may affect application functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Identity Manager, resulting in complete takeover. This impacts confidentiality, integrity, and availability of the system, potentially exposing sensitive identity management data and disrupting services.

Oracle has released patches for this vulnerability in the June 2026 Critical Security Patch Update. Customers should apply these security patches as soon as possible to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users, though these mitigations may disrupt normal application functionality. Oracle strongly recommends remaining on actively supported versions and applying patches promptly.