CVE-2026-21992
Published: March 20, 2026· Updated: Mar 23, 2026
Official Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. Note: Oracle Web Services Manager is installed with an Oracle Fusion Middleware Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Technical Analysis
CVE-2026-21992 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
News & Research Mentioning CVE-2026-21992
CVE-2026-21992 can be used without authentication for remote code execution and it may have been exploited in the wild. The post Oracle Releases Emergency Patch for Critical Identity Manager Vulnerability appeared first on SecurityWeek. [xlite_meta score:50 src:SecurityWeek xlite_fp:7aa49db939b13cf66f93f046d5be21ea8608c36b91d2c6f12cd38696673d497d]
Categories: Threat Research Tags: advisory, vulnerability, Oracle [xlite_meta score:36 src:Sophos X-Ops xlite_fp:9b63cd3876b86ad1866a29d900669e14d09df79f23b505d952fc67d4a30c1a6c]
Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2026-21992, carries a CVSS score of 9.8 out of a maximum of 10.0. "This vulnerability is remotely exploitable without authentication," Oracle said in an advisory. "If successfully [xlite_meta score:53 src:The Hacker News xlite_fp:6c6ebd2d5cc3dddc766daf4c2b088cb80e46f2415a4cefd58a85dc826cfa182e]
Oracle has released an out-of-band security update to fix a critical unauthenticated remote code execution vulnerability in Identity Manager and Web Services Manager tracked as CVE-2026-21992. [...] [xlite_meta score:58 src:BleepingComputer xlite_fp:b07cab86bc97a7a141aea778ed618edf3199c5709075b02f82683924681673fd]
All References (1)
Quick Facts
Known Threat Actors
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-21992 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts