A vulnerability in the Oracle Identity Manager legacy UI allows an attacker who can reach the system over HTTPS to compromise the application. The flaw enables the attacker to gain control of the system without needing elevated privileges, resulting in a potential full takeover. The CVSS 3.1 vector indicates severe impacts on confidentiality, integrity, and availability, meaning the compromised system can reveal, alter, or deny critical identity data and services.

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected. These releases are part of Oracle Fusion Middleware and are commonly deployed in enterprise identity governance environments.

The vulnerability requires only network connectivity over HTTPS and a low-privileged attacker account. With no known exploit code publicized, the risk is assessed by a CVSS score of 8.8. Since the EPSS score indicates a very low exploitation probability (<1%) and the flaw is not listed in CISA’s KEV catalog, the likelihood of exploitation depends on internal asset exposure. The attack vector is inferred as remote web-based access to the legacy UI, making it potentially exploitable by attackers who can reach the service or have an internal account.