This vulnerability affects Oracle Identity Manager, specifically the OIM Legacy UI component, in versions 12.2.1.4.0 and 14.1.2.1.0. It is exploitable over the network without authentication but requires user interaction from a third party. Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Identity Manager. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update, which contains numerous patches across multiple products including Oracle Identity Manager.

An attacker exploiting this vulnerability can gain unauthorized access to critical data within Oracle Identity Manager, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the system's data. There is no impact on availability reported. The vulnerability requires user interaction from a person other than the attacker, which is a prerequisite for successful exploitation.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks. No alternative mitigations or workarounds are specified in the advisory.