A flaw in the Oracle Identity Manager Legacy UI allows an attacker with modest privileges to use the HTTP interface to fully compromise the management service. The vulnerability is easily exploitable from remote networks and leads to a total loss of confidentiality, integrity, and availability: an attacker can read, modify, and delete all identity data and commands, effectively seizing control of the system. The weakness grants elevated rights without requiring authentication or privilege escalation, creating a path for full takeover.

Affected versions are Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, part of Oracle Fusion Middleware. Environment is accessed via standard HTTP endpoints; the flaw exists in the legacy user interface component.

The CVSS score of 8.8 signals a high severity. The attack vector is straightforward: an external attacker can reach the HTTP service over the network. Because no exploitation probability (EPSS) is available and the vulnerability is not listed in CISA's KEV, the exploit risk is unquantified but likely significant for exposed deployments. As the flaw allows complete takeover, the impact for affected sites is critical, especially for enterprises relying on identity management for privileged operations.