Oracle Issues Urgent Security Update for Critical RCE in Identity Manager and Web Services Manager

Oracle has released an out-of-band security alert to address a critical remote code execution vulnerability, tracked as CVE-2026-21992, affecting Oracle Identity Manager and Oracle Web Services Manager. With a CVSS 3.1 base score of 9.8 and no authentication required, this is a high-risk flaw that can be exploited remotely over HTTP with minimal complexity. Organizations running internet-facing Fusion Middleware components should treat this as an emergency.

What was disclosed

Vulnerability: CVE-2026-21992 — an unauthenticated, remotely exploitable RCE.
Affected components: Oracle Identity Manager (REST Web Services) and Oracle Web Services Manager (Web Services Security).
Severity: CVSS 3.1 base score 9.8 — high impact to Confidentiality, Integrity, and Availability.
Exploitability: Network-based, low complexity, no user interaction or special privileges required.

Affected versions (preserved from vendor advisory)

Product	Affected Versions
Oracle Identity Manager	12.2.1.4.0, 14.1.2.1.0
Oracle Web Services Manager	12.2.1.4.0, 14.1.2.1.0

Why this matters

Both products are commonly deployed across large enterprises and government environments. Oracle Identity Manager handles identity governance, and Web Services Manager enforces security policies for web services — compromise of either can lead to full system takeover, credential theft, and lateral movement across networks. Because the flaw requires only HTTP access to an exposed endpoint, internet-accessible instances are particularly at risk.

Immediate actions for administrators

Patch immediately: Apply Oracle’s provided patches from the Security Alert and My Oracle Support (Document ID KB878741). Oracle has issued updated guidance; follow it closely.
Prioritize exposure: Identify and remediate any externally reachable REST Web Services or Web Services Security endpoints first.
Upgrade unsupported versions: If you run releases outside Premier/Extended Support, plan upgrades—patches may not be available for unsupported versions.
Monitor and harden: Review logs and alerts for suspicious activity, restrict access with network controls where possible, and consider temporary mitigations (e.g., deny external HTTP access) until patches are applied.

Short-term mitigation checklist

Inventory Fusion Middleware instances and note which are internet-facing.
Block or restrict HTTP/HTTPS access to affected endpoints via firewall rules or web gateways.
Schedule immediate patch deployment and verify successful installation.
Communicate urgency to stakeholders and incident response teams.

Final note

This vulnerability is severe and easily exploitable. Quick, prioritized patching combined with network-level protections will significantly reduce the risk of exploitation. Stay tuned to Oracle’s Security Alerts portal for any follow-up advisories or mitigations.