This vulnerability exists in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically in the OIM Legacy UI component. It is easily exploitable remotely without authentication over HTTP, enabling attackers to compromise Oracle Identity Manager and potentially take full control. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0. Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability among 1449 others. The advisory emphasizes the importance of timely patching to prevent exploitation.

Successful exploitation allows an unauthenticated attacker with network access to completely compromise Oracle Identity Manager, resulting in full takeover. This impacts confidentiality, integrity, and availability of the system, potentially leading to unauthorized data access, modification, and service disruption.

Oracle has released security patches for this vulnerability as part of the July 2026 Critical Patch Update. Users of Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 should apply the relevant patches immediately. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory.