The vulnerability resides in the installer component of Oracle Identity Manager and can be exploited by an attacker who already has low‑privilege access to the host system. By leveraging this flaw the attacker can compromise the Identity Manager service, obtaining unauthorized access to critical data. This flaw is an instance of CWE-284 (Improper Access Control) and leads to a confidentiality breach, as the attacker can read or exfiltrate sensitive information managed by the product.

Oracle Identity Manager, version 12.2.1.4.0 and 14.1.2.1.0. The environment must be on Oracle Fusion Middleware and the installer component is affected. No other versions are listed as vulnerable.

The CVSS score is 5.5, indicating moderate impact with local attacks using low‑privilege credentials. Exploitation requires the attacker to already have a user account on the infrastructure where the product runs. The EPSS score is < 1%, indicating a very low but non-zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so no public exploits are reported yet. Organizations should treat this as a medium‑risk issue due to the potential to expose sensitive data.