The CA team has confirmed that all versions of CA Identity Suite are not vulnerable to this exploit.
CA Identity Suite Version 14.2 uses a vulnerable version of Apache Struts 126.96.36.199 in CA Identity Manager’s Management Console. Due to the implementation of Namespaces appropriately with default values, and no URL without Tags or with empty values, no malicious Remote Code could be inserted to exploit this vulnerability.
CA Identity Suite Versions 14.1 and earlier use an Apache Struts version 1 which is not susceptible to this vulnerability.
With the next release, CA Identity Suite 14.3, we will be updating Apache Struts to a version where this vulnerability is addressed.