Oracle Issues Emergency Patch for Unauthenticated RCE Flaw in Identity Manager and Web Services Manager

Summary

Oracle issued an emergency patch for critical CVE-2026-21992, an unauthenticated HTTP remote code execution flaw affecting specified versions of Oracle Identity Manager and Web Services Manager. Fixes are limited to supported releases; exploitation is unconfirmed.

Key points

CVE-2026-21992 affects Oracle Identity Manager and Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0.
The flaw can be exploited over HTTP without authentication to achieve remote code execution.
Oracle assigned the vulnerability a CVSS v3.1 score of 9.8 and issued an out-of-band Security Alert.
Patches are available only for versions under Premier or Extended Support; unsupported installations must be upgraded to receive fixes.
Oracle has not confirmed exploitation in real-world attacks, and its advisory cites no specific incidents.

Article Details

Vulnerability Types: Unauthenticated remote code execution (RCE)
Severity: Critical (CVSS v3.1 base score 9.8)
Affected Versions: Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Web Services Manager 12.2.1.4.0
Oracle Web Services Manager 14.1.2.1.0
Exploitation Status: not_reported
Exploit Availability: unknown
Patch Status: available
Workarounds: Apply the Security Alert patches for supported versions.
Upgrade unsupported releases to a supported version to receive the fix.