Full Report
Oracle has released an emergency out‑of‑band patch to address a critical vulnerability, tracked as CVE‑2026‑21992, that affects two core enterprise products: Oracle Identity Manager and Oracle Web Services Manager. The flaw, disclosed on March 19, 2026, carries a CVSS v3.1 base score of 9.8, placing it in the highest severity category and prompting an urgent advisory from the company’s Integrated Cyber Center (ICC). The vulnerability is notable because it can be exploited without authentication, meaning an attacker with network access could trigger remote code execution on affected systems over standard HTTP, without valid login credentials. The advisory explicitly warns that successful exploitation “may result in remote code execution”. What’s Affected: Products, Versions, and Risk The vulnerability affects specific versions of two products within Oracle’s Fusion Middleware suite: Oracle Identity Manager, versions 12.2.1.4.0 and 14.1.2.1.0 Oracle Web Services Manager, versions 12.2.1.4.0 and 14.1.2.1.0 In Identity Manager, the vulnerability resides in the REST WebServices component of the product, while in Web Services Manager it impacts the Web Services Security module. An attacker who successfully exploits this flaw could potentially take full control of systems running these services, manipulating identity governance workflows or altering security policies for other applications and services. According to Oracle’s advisory, the flaw’s low attack complexity and lack of authentication requirements increase the likelihood that opportunistic attackers could probe exposed systems and achieve remote code execution. For enterprises, this means that externally accessible instances of Identity Manager or Web Services Manager are particularly at risk until the patch is applied. Patch Release and Support Guidance Oracle delivered the fix via a Security Alert, an emergency update process used when a vulnerability is too severe to wait for the regular quarterly Critical Patch Update cycle. The company strongly recommends that customers apply the patches or mitigations provided in this alert “as soon as possible” and remain on supported versions of their products. However, the patches are only available for versions currently under Premier Support or Extended Support. Systems running older or unsupported releases may not receive the update, which Oracle warns could leave those installations vulnerable unless they are upgraded to a supported version. Exploitation in the Wild: What’s Known To date, Oracle has not confirmed that the vulnerability has been actively exploited in real‑world attacks, and the advisory does not reference any specific incidents of active exploitation. The company declined to comment on this when asked by security outlets, leaving uncertainty for defensive teams about whether the vulnerability is already being targeted by threat actors. This lack of transparency is notable, especially given in recent history. In November 2025, Oracle released a patch for another critical unauthenticated remote code execution vulnerability in Oracle Identity Manager that was later confirmed by independent researchers to have been exploited as a zero‑day prior to the patch. Wider Security Context The significance of the advisory is heightened by recent attacks targeting Oracle products. For example, vulnerabilities in Oracle’s E‑Business Suite (EBS) were leveraged in a large‑scale data theft campaign affecting more than 100 organizations, though Oracle has not publicly tied specific CVEs to those incidents. Security professionals warn that identity management infrastructure such as Oracle Identity Manager is often a high‑value target because it governs access across an enterprise. A full compromise of such systems could enable credential theft, privilege escalation, lateral movement, and broader network compromise.
Analysis Summary