Oracle has released an out-of-band security alert to address a critical remote code execution vulnerability, tracked as CVE-2026-21992, affecting Oracle Identity Manager and Oracle Web Services Manager. With a CVSS 3.1 base score of 9.8 and no authentication required, this is a high-risk flaw that can be exploited remotely over HTTP with minimal complexity. Organizations running internet-facing Fusion Middleware components