The vulnerability resides in the End User Self Service component of Oracle Identity Manager. An attacker without authentication who can reach the system via IIOP may exploit the flaw to perform unauthorized insert, update, or delete operations and to read restricted data. The resulting confidentiality and integrity impact is reflected in a CVSS‑3.1 Base Score of 6.5, indicating moderate severity.

Oracle Corporation Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected.

The flaw is exploitable over the network through the IIOP protocol and requires no user credentials, giving the attacker full control over certain data within Identity Manager. The EPSS score of less than 1% suggests a low probability of exploitation observed to date, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, because the attack permits data modification and disclosure, it warrants prompt remediation.