This vulnerability in Oracle Identity Manager's Legacy UI component allows unauthenticated remote attackers to gain unauthorized access and perform critical data operations such as creation, deletion, or modification. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation details for it. Customers are strongly advised to apply Oracle's Critical Patch Updates promptly to mitigate such vulnerabilities.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data within Oracle Identity Manager. This can lead to compromise of confidentiality and integrity of all data accessible by Oracle Identity Manager. There is no reported impact on availability. No known exploits in the wild have been reported as of the advisory date.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple security vulnerabilities, including this one. However, the provided data does not explicitly confirm the availability of a specific patch or remediation for CVE-2026-61197. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security patches without delay. Until patches are applied, no vendor-provided temporary mitigations are documented in the advisory.