Oracle Identity Manager (OIM) is vulnerable due to a flaw in the legacy user interface component. A low‑privileged attacker with network access to the T3 or IIOP protocols can compromise the system. Successful exploitation would allow an attacker to take complete control of OIM, resulting in full loss of confidentiality, integrity, and availability. The vulnerability is assessed with a CVSS 3.1 base score of 8.8, reflecting high impact and low attack complexity.

Affected versions are Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0. These releases are part of the Oracle Fusion Middleware suite and are deployed in many enterprise environments that manage identity, governance, and privileged access. Only the legacy UI component of OIM is impacted; other modules are not mentioned.

The risk is high because the flaw can be exploited over the network with only local privileges and no user interaction. The EPSS score is not available, but the CVSS score and absence of remediation listed in KEV indicate that it has not yet been widely attacked in the wild. Attackers would likely use the exposed T3/IIOP interfaces to send crafted requests that bypass authorization checks, taking advantage of the CWE‑284 and CWE‑732 weaknesses. Until a patch is applied, the vulnerability remains exploitable.