This vulnerability exists in the Oracle Identity Manager product, specifically in the OIM Legacy UI component. It allows a low privileged attacker with network access via HTTP to compromise Oracle Identity Manager, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high impact on confidentiality, integrity, and availability. The attack complexity is high, and no user interaction is required. The vulnerability scope is changed, meaning successful exploitation may affect other Oracle products. A vendor advisory is available but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to complete compromise of Oracle Identity Manager, affecting confidentiality, integrity, and availability of the system. The scope change indicates that other Oracle products integrated or dependent on Oracle Identity Manager may also be impacted. This could result in significant operational and security risks for affected organizations.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly. Since no explicit patch information is provided for this vulnerability, organizations should monitor Oracle's advisories closely and apply any relevant patches as soon as they become available.