LmCast :: Stay tuned in

Oracle pushes emergency fix for critical Identity Manager RCE flaw

Recorded: March 20, 2026, 9 p.m.

Original Summarized

Oracle pushes emergency fix for critical Identity Manager RCE flaw

News

Featured
Latest

Trivy vulnerability scanner breach pushed infostealer via GitHub Actions

Microsoft Azure Monitor alerts abused for callback phishing attacks

Musician admits to $10M streaming royalty fraud using AI bots

FBI links Signal phishing attacks to Russian intelligence services

Varonis Atlas: Securing AI and the Data That Powers It

Microsoft Exchange Online service change causes email access issues

Block ads and trackers on 9 devices for only $16 in this deal

FBI warns of Handala hackers using Telegram in malware attacks

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityOracle pushes emergency fix for critical Identity Manager RCE flaw

Oracle pushes emergency fix for critical Identity Manager RCE flaw

By Lawrence Abrams

March 20, 2026
02:48 PM
0

Update: Added that Oracle declined to comment on whether the vulnerability has been exploited.
Oracle has released an out-of-band security update to fix a critical unauthenticated remote code execution vulnerability in Identity Manager and Web Services Manager tracked as CVE-2026-21992.
Oracle Identity Manager is used for managing identities and access across an enterprise, while Oracle Web Services Manager provides security and management controls for web services.
In an advisory released yesterday, Oracle is "strongly" recommending that customers apply the patches as soon as possible.
"This Security Alert addresses vulnerability CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution," reads the security advisory.
"Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible. Oracle always recommends that customers remain on actively-supported versions and apply all Security Alerts and Critical Patch Update security patches without delay."
The CVE-2026-21992 vulnerability has a CVSS v3.1 severity score of 9.8 and impacts Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, as well as Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0.
Oracle says the flaw is of low complexity, remotely exploitable over HTTP, and does not require authentication or user interaction, increasing the risk of exploitation on exposed servers.
The fix was released through its Security Alert program, which delivers out-of-schedule fixes or mitigations for critical or actively exploited vulnerabilities. However, Oracle says that patches released through these programs are only offered for versions under Premier or Extended Support, and older unsupported versions may be vulnerable.
Oracle has not disclosed whether the vulnerability has been exploited and declined to comment when BleepingComputer asked about its exploitation status.
In a separate blog post published today, Oracle once again noted the severity of CVE-2026-21992 and warned customers to review the security alert for full details and patch information.

Red Report 2026: Why Ransomware Encryption Dropped 38%
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.
Download The Report

Related Articles:
CISA orders feds to patch max-severity Cisco flaw by SundayVeeam warns of critical flaws exposing backup servers to RCE attacksCisco fixes critical pre-auth bugs in SD-WAN, cloud license managerCisco fixes bug allowing remote code execution with root privilegesMail2Shell zero-click attack lets hackers hijack FreeScout mail servers

CVE-2026-21992
Oracle
Oracle Identity Manager
Out-of-Band
Pre-Authentication
Remote Code Execution
Vulnerability

Lawrence Abrams
Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies.

Previous Article
Next Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

Popular Stories

Microsoft: March Windows updates break Teams, OneDrive sign-ins

CISA orders feds to patch max-severity Cisco flaw by Sunday

Microsoft Azure Monitor alerts abused for callback phishing attacks

Sponsor Posts

Overdue a password health-check? Audit your Active Directory for free

Secure your AI agents without sacrificing speed.

Are refund fraud methods targeting your brand? You can monitor the underground for these threats.

AI is a data-breach time bomb: Read the new report

Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast.

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

Oracle has issued an emergency security update to address a critical Remote Code Execution (RCE) vulnerability within its Identity Manager and Web Services Manager software. The vulnerability, tracked as CVE-2026-21992, presents a significant risk due to its remotely exploitable nature and the absence of authentication requirements. This means an attacker could potentially execute code on systems exposed to the internet without needing credentials or user interaction. The vulnerability specifically affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, as well as Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0.

The CVSS v3.1 severity score assigned to CVE-2026-21992 is 9.8, indicating a high level of risk. The vulnerability is characterized as low complexity, exploitable over HTTP, and lacking any authentication or user interaction prerequisites. This combination makes it a high priority for security teams to remediate. Oracle strongly recommends that customers implement the updates or mitigations provided in the security alert as quickly as possible, referencing the continued recommendation to remain on actively-supported versions and promptly apply all Security Alerts and Critical Patch Update security patches.

The emergency update was delivered through Oracle’s Security Alert program, a mechanism used to swiftly address critical or actively exploited vulnerabilities. However, it’s important to note that these Security Alert patches are typically offered only for versions under Premier or Extended Support. Consequently, older unsupported versions may still be susceptible to the vulnerability. Oracle has not yet disclosed whether the flaw has been actively exploited, and declines to provide additional details regarding the situation.

The advisory highlights the potential for a successful exploit to result in remote code execution, a particularly damaging outcome. This emphasizes the need for proactive security measures, including network segmentation, intrusion detection systems, and robust security monitoring. Oracle stresses the importance of reviewing the full security alert for complete details and patch information. The vulnerability's absence of authentication requirements amplifies the potential impact, demanding immediate attention from system administrators and security professionals. The vulnerability’s technical details suggest a flaw within the web services management, requiring immediate action to limit exposure.