This vulnerability affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 and is exploitable by a low privileged attacker with network access via T3 or IIOP protocols. The attacker can compromise the Identity Manager, potentially leading to a full takeover of the product and impacting other Oracle products (scope change). The vulnerability is scored 9.9 on CVSS 3.1, reflecting critical impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes patches addressing this vulnerability. Oracle strongly recommends applying these patches without delay. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt application functionality.

Successful exploitation allows an attacker with low privileges and network access to take over Oracle Identity Manager, compromising confidentiality, integrity, and availability of the system. The attack surface includes network protocols T3 and IIOP. The compromise of Identity Manager can also significantly impact other Oracle products due to scope change.

Oracle has released patches for this vulnerability in the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking the T3 and IIOP network protocols or by removing unnecessary privileges from users who do not require them. However, these mitigations may disrupt normal application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay.