The vulnerability allows an attacker with low privileges and network access via HTTP to take control of Oracle Identity Manager. The weakness is a missing or incorrect permission check (CWE-306). Successful exploitation would grant the attacker full compromise of the system, resulting in loss of confidentiality, integrity, and availability of the managed identities and related services.

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected.

The CVSS 3.1 base score of 8.8 denotes a high severity. The EPSS score of <1% indicates a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA KEV. Attackers would need to reach the Identity Manager REST WebServices over HTTP, so the threat is primarily remote and requires network connectivity to the affected service. Once accessed, the attacker could take over the application and its underlying resources.