cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Oracle Issues Out-of-Band Fix for Critical Identity Manager RCE Flaw

· Original article ↗

Summary

Oracle released an out-of-band fix for CVE-2026-21992, an unauthenticated remote code execution flaw affecting Oracle Identity Manager and Web Services Manager. Oracle recommends prompt patching but has not disclosed whether the flaw was exploited.

Key points

  • CVE-2026-21992 affects Oracle Identity Manager and Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0.
  • Oracle says the flaw is remotely exploitable over HTTP without authentication or user interaction and has a CVSS v3.1 score of 9.8.
  • Oracle released patches or mitigations through its Security Alert program and strongly recommends applying them as soon as possible.
  • The alert's fixes are offered only for versions under Premier or Extended Support; older unsupported versions may remain vulnerable.
  • Oracle declined to comment on whether the vulnerability has been exploited.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution (RCE)
Severity
Critical (CVSS v3.1: 9.8)
Affected Versions
  • Oracle Identity Manager 12.2.1.4.0
  • Oracle Identity Manager 14.1.2.1.0
  • Oracle Web Services Manager 12.2.1.4.0
  • Oracle Web Services Manager 14.1.2.1.0
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Apply the patches or mitigations provided in Oracle's Security Alert.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationCVE-2026-21992 is remotely exploitable over HTTP without authentication in Oracle Identity Manager and Oracle Web Services Manager.

CVE

CVE-2026-21992Oracle Corporation · Oracle Identity Manager; Oracle Corporation · Oracle Web Services ManagerOracle released an out-of-band security update to address a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager.

Vendors

OracleOracle released an out-of-band security update to address a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager.

Products

Oracle Identity ManagerOracle released an out-of-band security update to address a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager.Oracle Web Services ManagerOracle released an out-of-band security update to address a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager.

Related Articles