This vulnerability exists in the Oracle Identity Manager product component OIM Legacy UI. It is easily exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can lead to complete takeover of Oracle Identity Manager and may affect other Oracle products due to scope change. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability. The affected versions are 12.2.1.4.0 and 14.1.2.1.0. Oracle has published a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability.

An attacker with low privileges and network access can fully compromise Oracle Identity Manager, leading to complete takeover of the system. This includes full confidentiality, integrity, and availability impacts. Additionally, the compromise may affect other Oracle products due to the scope change described. The vulnerability is rated critical with a CVSS score of 9.9.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches without delay to mitigate the risk. Oracle recommends staying on actively supported versions and promptly applying patches as part of their security best practices.