The Oracle Identity Manager Connector 12.2.1.4.0 contains an easily exploitable flaw that permits an unauthenticated attacker with network access via HTTPS to create, delete, or modify data accessible through the connector. This grants the attacker full read access to critical data or the ability to alter any information stored or processed by the connector. The vulnerability carries high confidentiality and integrity impacts as identified in the CVSS 3.1 base score of 9.1, with no availability impact noted.

Affected systems are Oracle Identity Manager Connector versions 12.2.1.4.0 within Oracle Fusion Middleware. The product is distributed by Oracle Corporation. No other versions are reported in the vendor's advisory for this specific CVE.

Given the CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, the vulnerability can be exploited over the public Internet without authentication or user interaction. The lack of an EPSS score indicates that the exploitation probability is not quantified, but the severity remains high. The vulnerability is not listed in CISA's KEV catalog, so there is no publicly known exploitation at the time of reporting.