cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Oracle Patches Critical Unauthenticated RCE in Identity Manager and Web Services Manager

· Original article ↗

Summary

Oracle released updates for CVE-2026-21992, a CVSS 9.8 flaw enabling unauthenticated remote code execution over HTTP in specified versions of Identity Manager and Web Services Manager. No in-the-wild exploitation has been reported.

Key points

  • CVE-2026-21992 has a CVSS score of 9.8 and could allow unauthenticated remote code execution over HTTP, according to Oracle and the NVD.
  • Affected versions are Oracle Identity Manager and Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.1.0.
  • Oracle released security updates and urged customers to apply them promptly.
  • Oracle has not reported in-the-wild exploitation of CVE-2026-21992.
  • Separately, CISA added Oracle Identity Manager flaw CVE-2025-61757 to its KEV catalog in November 2025, citing active exploitation.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution
Severity
Critical (CVSS 9.8)
Affected Versions
  • Oracle Identity Manager 12.2.1.4.0
  • Oracle Identity Manager 14.1.2.1.0
  • Oracle Web Services Manager 12.2.1.4.0
  • Oracle Web Services Manager 14.1.2.1.0
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationCVE-2026-21992 could allow an unauthenticated attacker with network access over HTTP to compromise Oracle Identity Manager or Oracle Web Services Manager.

CVE

CVE-2025-61757Oracle Corporation · Identity ManagerIn November 2025, CISA added a related pre-auth RCE (CVE-2025-61757) affecting Oracle Identity Manager to the KEV list due to active exploitation.CVE-2026-21992Oracle Corporation · Oracle Identity Manager; Oracle Corporation · Oracle Web Services ManagerOracle has released security updates to fix a critical, remotely exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager that could allow unauthenticated remote code

Vendors

OracleOracle has released security updates to fix a critical, remotely exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager that could allow unauthenticated remote code

Products

Oracle Identity Managersecurity updates to fix a critical, remotely exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager that could allow unauthenticated remote code execution.Oracle Web Services Managera critical, remotely exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager that could allow unauthenticated remote code execution.

Related Articles