This vulnerability exists in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically in the OIM Legacy UI component. It is easily exploitable by a high privileged attacker with network access via HTTP. Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Identity Manager, including unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 7.6, reflecting high confidentiality impact and partial integrity impact. Oracle's advisory confirms that patches addressing this vulnerability are included in the September 2026 Critical Security Patch Update.

Exploitation of this vulnerability can lead to unauthorized access to critical data managed by Oracle Identity Manager and unauthorized modification (update, insert, delete) of some of this data. The scope of impact may extend beyond Oracle Identity Manager to additional products. The CVSS score indicates a high impact on confidentiality and a partial impact on integrity, with no impact on availability.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.