This vulnerability affects Oracle Identity Manager's Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0. It is exploitable remotely without authentication over HTTP, enabling attackers to gain unauthorized access to critical data and perform unauthorized data modifications. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. Oracle has published a Critical Patch Update advisory in July 2026 covering this and other vulnerabilities, but no explicit patch or remediation level for this specific issue is stated in the advisory content provided.

An attacker can remotely and unauthenticatedly access Oracle Identity Manager via HTTP and gain unauthorized access to critical data. This includes the ability to create, delete, or modify data, potentially compromising the integrity and confidentiality of all data accessible through Oracle Identity Manager. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update advisory in July 2026 that includes security patches for Oracle Identity Manager and other products. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since no explicit patch or remediation level is stated for this vulnerability in the advisory content provided, users should verify patch availability and installation instructions from Oracle's official resources. Maintaining up-to-date patched versions is critical to mitigate this vulnerability.