This vulnerability in Oracle Identity Manager's REST WebServices component allows an attacker with low privileges and network access via HTTP to perform unauthorized actions on critical data. The affected versions are 12.2.1.4.0 and 14.1.2.1.0. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates that the attack can be performed remotely with low attack complexity, requires low privileges, no user interaction, and results in high confidentiality and integrity impact. No official remediation level or patch information is provided in the advisory, but Oracle's July 2026 Critical Patch Update advisory should be consulted for patch availability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Identity Manager. This compromises confidentiality and integrity of the system's data, potentially allowing attackers to manipulate or exfiltrate sensitive information. There is no impact on availability reported.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is applied, restrict network access to Oracle Identity Manager REST WebServices to trusted users only.