A vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows an unauthenticated attacker with network access over HTTP to perform unauthorized data manipulation, including creation, deletion, or modification of critical data, and to gain full access to all data that the connector can reach. The weakness arises from improper access control and authentication bypass, enabling the attacker to circumvent required privileges completely. The impact includes loss of confidentiality and integrity of sensitive information associated with the connector and potential scope expansion to other Oracle products.

The affected product is Oracle Identity Manager Connector, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. The advisory notes that the scope change may affect additional Oracle products, meaning affected environments should review all related components.

The CVSS v3.1 score of 8.7 reflects a high severity with significant confidentiality and integrity consequences and a scope change. Exploitation requires network access over HTTP and does not need authentication but has high attack complexity. The EPSS score is less than 1%, indicating a low probability of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Nevertheless, because the flaw permits full unauthorized data manipulation and can affect other products, the risk remains high and warrants prompt remediation.