This vulnerability in Oracle Identity Manager (OIM Legacy UI component) affects versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by unauthenticated attackers over HTTP, allowing full compromise of the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among many others but does not explicitly state patch availability or remediation instructions for these specific versions. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation allows an unauthenticated attacker with network access via HTTP to take over Oracle Identity Manager, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized access, data compromise, and disruption of identity management services.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for the affected versions. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information. Oracle strongly recommends applying security patches promptly on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Identity Manager interfaces and monitor for unusual activity.