A high-severity vulnerability exists in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 that allows a low-privileged attacker with network access via HTTP to potentially take over the system. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update.