This vulnerability in Oracle Fusion Middleware Identity Manager's legacy UI component allows unauthenticated remote attackers to exploit network access via T3 and IIOP protocols to compromise the system. The flaw affects specifically versions 12.2.1.4.0 and 14.1.2.1.0 of Identity Manager. Successful exploitation can lead to complete takeover of the Identity Manager, impacting confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS 3.1 score of 9.8. Oracle has addressed this issue in its June 2026 Critical Security Patch Update, which includes targeted patches for this and other vulnerabilities. Oracle strongly recommends applying these patches immediately. Workarounds such as blocking the T3 and IIOP protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt normal operations.

An unauthenticated attacker with network access via T3 or IIOP can fully compromise Oracle Identity Manager, leading to complete takeover of the system. This results in high impact on confidentiality, integrity, and availability of the affected product. The vulnerability is critical and can be exploited remotely without user interaction or privileges.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking the T3 and IIOP network protocols or by removing unnecessary privileges from users; however, these mitigations may affect application functionality. Oracle strongly recommends remaining on actively supported versions and promptly applying all security updates.