An attacker with low privileges who can reach the Oracle Identity Manager web interface over HTTP can exploit a vulnerability in the legacy UI component to take complete control of the OIM instance. The flaw allows the attacker to compromise confidentiality, integrity, and availability of all managed identities and potentially other downstream applications, as the vulnerability carries a scope change. The CVSS 3.1 base score of 9.9 and the vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicate a highly severe risk that is readily exploitable over a network connection with minimal effort.

The affected products are Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 from Oracle Corporation. No other product versions are listed as vulnerable.

The CVSS score of 9.9 places this issue in the critical severity range. While the EPSS score is not available, the lack of an available exploitation rate does not diminish the classified attack path, involving HTTP access to the Legacy UI. The vulnerability is not listed in the CISA KEV catalog, but the high severity score and scope change endorse a rapid response to mitigate potential compromise. An attacker with simple network access can exercise the vulnerability without authentication or user interaction, suggesting the potential for automated exploitation if a host is exposed.