The vulnerability in Oracle Identity Manager allows an unauthenticated attacker with network access over T3 or IIOP to bypass authentication controls and fully compromise the component that manages end‑user self‑service. Successful exploitation results in the attacker taking over the entire Identity Manager instance, granting full confidentiality, integrity, and availability breaches. This is effectively a critical remote code execution flaw.

Affected products include Oracle Corporation's Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, both part of Oracle Fusion Middleware. Only these specific builds are known to contain the vulnerability.

The CVSS 3.1 base score of 9.8 indicates a high likelihood of exploitation if the system is exposed to the public network. The EPSS score of 0.00384 indicates a very low but non‑zero exploitation probability, while the vulnerability is listed in Oracle’s CPU Oct 2026 advisory and is not yet present in the CISA KEV catalog. Attackers can reach the target via standard network protocols without authentication, implying that any exposed instance is at risk of complete takeover.