cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Oracle Issues Emergency Patch for Critical Identity Manager Vulnerability

· Original article ↗

Summary

Oracle issued out-of-band patches for critical CVE-2026-21992, an unauthenticated remote-code-execution flaw affecting Identity Manager and Web Services Manager. Oracle has not said whether it was exploited in the wild.

Key points

  • CVE-2026-21992 affects Oracle Identity Manager's REST WebServices component and Web Services Manager's Web Services Security component.
  • Oracle describes the flaw as easily exploitable by an unauthenticated attacker with network access via HTTP; successful exploitation could result in product takeover.
  • The vulnerability has a CVSS score of 9.8.
  • Oracle issued out-of-band updates and published a security alert urging organizations to apply the patches.
  • Oracle has not clearly stated whether the flaw has been exploited in the wild.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution
Severity
Critical (CVSS 9.8)
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-21992Oracle Corporation · Oracle Identity Manager; Oracle Corporation · Oracle Web Services ManagerOracle revealed that the products, part of the Fusion Middleware suite, are affected by CVE-2026-21992, a critical vulnerability that can be exploited by an unauthenticated attacker for remote code execution.

Vendors

OracleOracle on Friday issued out-of-band updates to patch a critical vulnerability affecting its Identity Manager and Web Services Manager products.

Products

Oracle Identity ManagerOracle Identity Manager is an enterprise identity governance platform that automates user provisioning, deprovisioning, and access management across applications and systems.Oracle Web Services ManagerOracle Web Services Manager is a policy-driven framework for managing and protecting web services.

Related Articles