Oracle Patches Critical RCE Flaw in Identity Manager and Web Services Manager

Key Takeaways

• Oracle has released an out-of-band security alert for a critical remote code execution (RCE) vulnerability, CVE-2026-21992.
• The flaw impacts Oracle Identity Manager and Oracle Web Services Manager, both widely used Fusion Middleware components.
• Rated with a CVSS 3.1 score of 9.8, the vulnerability is unauthenticated, network-exploitable, and requires low complexity to execute.
• Immediate patching is strongly recommended for affected versions 12.2.1.4.0 and 14.1.2.1.0 to prevent full system compromise.

Critical Oracle RCE Flaw Demands Immediate Patching in Identity and Web Services Managers

Oracle has issued an urgent, out-of-band Security Alert addressing a severe remote code execution (RCE) vulnerability, tracked as CVE-2026-21992. This critical flaw affects two core components of Oracle Fusion Middleware: Oracle Identity Manager and Oracle Web Services Manager.

The vulnerability has been assigned a CVSS 3.1 base score of 9.8, placing it at the highest end of Oracle’s severity spectrum and indicating an extreme risk to affected systems.

Technical Details of CVE-2026-21992

CVE-2026-21992 is characterized as an unauthenticated, remotely exploitable vulnerability. Its exploitation requires no user interaction or special privileges, making it particularly dangerous. The attack vector is network-based, with low attack complexity, meaning a malicious actor only needs HTTP access to an exposed endpoint to potentially trigger remote code execution.

A successful exploit of this vulnerability could lead to high impacts across confidentiality, integrity, and availability categories. This signifies that an attacker could gain complete control over the compromised system, potentially leading to data theft, system alteration, or service disruption.

Specifically, within Oracle Identity Manager, the vulnerability resides in the REST Web Services component. For Oracle Web Services Manager, the flaw is located in the Web Services Security module. Oracle highlights that Web Services Manager is frequently deployed alongside Oracle Fusion Middleware Infrastructure, which could broaden the attack surface across various enterprise environments.

Affected Products and Versions

The following product versions are impacted by CVE-2026-21992:

These affected versions are part of the Fusion Middleware patch track. Comprehensive patch documentation is accessible via Oracle’s Security Alert advisory page and My Oracle Support (Document ID KB878741).

Implications for Organizations

Given the CVSS score of 9.8 and the absence of authentication requirements, this vulnerability poses a significant threat to organizations utilizing internet-facing Oracle Fusion Middleware deployments. Both Oracle Identity Manager, a critical identity governance platform, and Oracle Web Services Manager, responsible for security policy enforcement, are foundational infrastructure components in many large enterprises and government entities.

Exploiting these systems could result in full system compromise, the theft of credentials, and lateral movement within connected networks. Oracle initially released the alert on March 19, 2026, with a revised version published on March 20, 2026, including additional notes.

Oracle strongly advises all customers to apply the available patches without delay. Organizations operating unsupported versions of these products are urged to upgrade to a supported release, as patches are exclusively provided for versions under Premier Support or Extended Support phases, in accordance with Oracle’s Lifetime Support Policy.

What You Should Do

• Immediately apply the patches provided by Oracle for affected versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager and Oracle Web Services Manager.
• Prioritize patching any instances of these products that are accessible from the internet or exposed to external networks.
• Review and limit HTTP/HTTPS exposure of REST Web Services and Web Services Security endpoints until remediation is complete.
• For unsupported product versions, plan and execute an upgrade to a supported release to ensure patch eligibility.
• Consult Oracle’s official Security Alerts portal for the full risk matrix and detailed CVE information.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.