This vulnerability in Oracle Fusion Middleware's Identity Manager REST WebServices component affects versions 12.2.1.4.0 and 14.1.2.1.0. It permits an unauthenticated attacker with network access over HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, no confidentiality or availability impact, but high integrity impact. Oracle has published a Critical Security Patch Update advisory recommending prompt patch application to mitigate this and other vulnerabilities. No explicit patch or fix version is stated in the provided data, but Oracle strongly advises applying the June 2026 Critical Security Patch Update.

Exploitation of this vulnerability can result in unauthorized modification of critical data or all data accessible through Oracle Identity Manager. This compromises data integrity but does not affect confidentiality or availability according to the CVSS vector. The vulnerability is exploitable remotely without authentication, increasing the risk of compromise if unpatched.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges or package access from users. These mitigations may impact application functionality. Patch status is not explicitly confirmed in the advisory text, so customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.