This vulnerability affects Oracle Identity Manager's Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0. It permits unauthenticated remote attackers to gain unauthorized access and perform critical data manipulation or access operations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. No official patch or remediation level is explicitly stated in the vendor advisory, but the vulnerability is included in Oracle's July 2026 Critical Patch Update, which contains numerous security patches. Oracle strongly recommends applying available patches promptly to mitigate such vulnerabilities.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Identity Manager or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive information managed by Oracle Identity Manager. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While no explicit patch link or remediation level is provided in the advisory content, Oracle recommends customers apply security patches without delay and remain on actively supported versions. Organizations using affected versions 12.2.1.4.0 and 14.1.2.1.0 should review the July 2026 Critical Patch Update documentation and apply relevant patches promptly to remediate this vulnerability.