Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager

Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager Ravie LakshmananMar 21, 2026Vulnerability / Threat Intelligence Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2026-21992, carries a CVSS score of 9.8 out of a maximum of 10.0. "This vulnerability is remotely exploitable without authentication," Oracle said in an advisory. "If successfully exploited, this vulnerability may result in remote code execution." CVE-2026-21992 affects the following versions - Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0 According to a description of the flaw in the NIST National Vulnerability Database (NVD), it's "easily exploitable" and could allow an unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. This, in turn, can result in the successful takeover of susceptible instances. Oracle makes no mention of the vulnerability being exploited in the wild. However, the tech giant has urged customers to apply the update without delay for optimal protection. In November 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-61757 (CVSS score: 9.8), a pre-authenticated remote code execution flaw impacting Oracle Identity Manager, to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  cybersecurity, enterprise security, Identity Management, network security, oracle, Patch Management, remote code execution, Threat Intelligence, Vulnerability Trending News Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days Veeam Patches 7 Critical Backup and Replication Flaws Allowing Remote Code Execution CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack and More Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS ⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents and More OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026 Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit Researchers Trick Perplexity's Comet AI Browser Into Phishing Scam in Under Four Minutes FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8 Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware Load More ▼ Popular Resources Guide - Discover How to Validate AI Risks With Adversarial Testing Get the 2026 ASV Report to Benchmark Top Validation Tools Webinar - Identify Key Attack Paths to Your Crown Jewels with CSMA Fix Security Noise by Focusing Only on Validated Exposures