This vulnerability affects Oracle Identity Manager in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It permits a high privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible through Oracle Identity Manager. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impact without availability impact. The vulnerability may also impact other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability and recommends applying patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Identity Manager, or unauthorized access to all data accessible through it. The vulnerability affects confidentiality and integrity with a high severity score of 8.7. There is no reported impact on availability. The scope change indicates that additional Oracle products integrated with or dependent on Oracle Identity Manager may also be impacted.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No indication of temporary workarounds or no-action-required status is provided, so patching is the primary mitigation.