This vulnerability affects the Oracle Identity Manager product within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable flaw that requires no authentication and can be triggered remotely over HTTP. Successful exploitation can lead to full compromise of the Oracle Identity Manager system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its August 2026 Critical Security Patch Update, which contains 943 security patches across multiple products. Oracle strongly recommends applying these patches without delay.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to take over Oracle Identity Manager. This results in complete compromise of the system, affecting confidentiality, integrity, and availability of the affected product. The critical severity and high CVSS score reflect the potential for severe damage if exploited.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the relevant patches for Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 as soon as possible. Oracle advises remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are indicated in the vendor advisory.