The vulnerability allows an attacker who already has high privileges and can reach Oracle Identity Manager over HTTP to create, delete, or modify critical data. Successful exploitation can result in unauthorized access to all data managed by the product and the potential to affect other components within the Oracle Fusion Middleware stack. This access‑control weakness has a direct impact on confidentiality and integrity.

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected, as identified by Oracle’s own product listings. The flaw resides in the Security component of the Fusion Middleware distribution.

The CVSS base score of 8.7 marks this as a high‑severity issue. The attack vector is over the network with low effort (AV:N/AC:L), requires high privileges (PR:H), and needs no user interaction (UI:N), while the scope change (S:C) can impact more than the primary product. EPSS data is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, so known public exploits are not documented. Nonetheless, the high severity, scoped impact, and requirement for high privileges demand prompt remediation, especially in environments where privileged users can access the Identity Manager service directly.