This vulnerability affects Oracle Identity Manager's REST WebServices component in versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized actions that compromise data integrity, including creation, deletion, or modification of critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, but high integrity impact. Oracle's June 2026 Critical Security Patch Update includes patches for this vulnerability. Oracle strongly recommends applying these patches immediately. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but can affect application functionality.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical or all data accessible through Oracle Identity Manager. This compromises data integrity but does not affect confidentiality or availability. The impact is significant as it allows full unauthorized data manipulation within the affected product versions.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Patch status is confirmed by the vendor advisory linked in the input.