This vulnerability exists in the REST WebServices component of Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to compromise the Identity Manager, potentially leading to full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. The vendor strongly recommends applying these patches without delay. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges, but these may affect application functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Identity Manager, impacting confidentiality, integrity, and availability of the system. This can lead to complete takeover of the Identity Manager environment.

Oracle has released security patches addressing this vulnerability in the June 2026 Critical Security Patch Update. Customers should apply these patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users, though these mitigations may disrupt normal application functionality. Patch status is confirmed by the vendor advisory. No cloud service remediation applies as this is not a cloud service.