This vulnerability affects Oracle Identity Manager's OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0. It permits a low privileged attacker with network access via HTTP to gain unauthorized access that can lead to creation, deletion, or modification of critical data or full access to all data accessible by Oracle Identity Manager. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vendor advisory references a Critical Patch Update released in July 2026 covering many products but does not explicitly confirm the patch availability or remediation level for this specific vulnerability.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Identity Manager. This compromises the confidentiality and integrity of the system's data but does not impact availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Identity Manager interfaces to trusted users only.