The vulnerability exists in the Legacy UI component of Oracle Identity Manager and allows an attacker with only low-level privileges and network access via Remote Method Invocation (RMI) to gain control of the system. Successful exploitation can lead to full takeover of Oracle Identity Manager, compromising all data managed by the platform. The weakness is fundamentally an improper access control flaw that permits unauthorized execution of code, as indicated by the high CVSS score and the RMI attack vector. The impact spans confidentiality, integrity, and availability; once executed, attackers can exfiltrate data, modify or delete identities, and disrupt services.

Oracle Corporation’s Oracle Identity Manager product, specifically the 12.2.1.4.0 and 14.1.2.1.0 releases, is affected. The CPE entries confirm that these exact major revisions contain the vulnerability. No other vendors or product lines are listed as impacted by this specific flaw.

With a CVSS 3.1 base score of 9.9, the vulnerability is considered Critical. The EPSS score is not available, but the high base score suggests strong potential for exploitation. It is not currently listed in the CISA Known Exploited Vulnerabilities catalog, implying no publicly documented exploits at present. Attackers would need to contact the RMI service exposed by the OIM Legacy UI, and though the required privilege level is low, the presence of the flaw allows privilege escalation to complete system compromise. The scope change indicates that exploitation may affect other components of the Oracle Identity Manager stack beyond the UI, potentially broadening the threat surface.