Oracle fixes critical RCE flaw CVE-2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-61757 | Unauthenticated Takeover of Oracle Identity Manager via REST WebServices CVE-2025-61757 is a critical missing-authentication flaw (CWE-306) in the REST WebServices component of Oracle Identity Manager, part of Oracle Fusion Middleware, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access can send HTTP requests to the REST endpoints without any credentials or user interaction. Successful exploitation results in takeover of Identity Manager, with high-impact confidentiality, integrity, and availability consequences (CVSS 3.1 base score 9.8). Any organization running the affected versions of Oracle Identity Manager — typically large enterprises and public-sector organizations using it for identity and access management — is exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-21, news reports describe it as an actively exploited zero-day, and EPSS assigns an 88.3% probability of exploitation within 30 days. Do: Immediately apply Oracle's fix for CVE-2025-61757 to Identity Manager 12.2.1.4.0 and 14.1.2.1.0 per Oracle's security advisory (federal agencies must follow BOD 22-01 timelines). Until patching is complete, restrict untrusted and internet-facing HTTP access to the Identity Manager REST WebServices endpoints, and review logs for signs of compromise given confirmed in-the-wild exploitation. Also verify that the separate unauthenticated RCE in Identity Manager (CVE-2026-21992), which Oracle has patched, is remediated in the same maintenance cycle. | 9.8 | 88% | KEV |
| largeon the order of tens of thousands of enterprise deployments worldwide; the share with the REST endpoint exposed over HTTP is unknown | |
| CVE-2026-21992 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. Note: Oracle Web Services Manager is installed with an Oracle Fusion Middleware Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD description · AI analysis pending | 9.8 | 1% |
| — |
Full article382 words · extracted from securityaffairs.com · click to collapse
Oracle fixed a critical severity flaw, tracked as CVE-2026-21992, enabling unauthenticated remote code execution in Identity Manager.
Oracle released security updates to address a critical vulnerability, tracked as CVE-2026-21992 (CVSS score of 9.8), affecting Identity Manager and Web Services Manager.
The flaw lets unauthenticated attackers over HTTP take control of Oracle Identity Manager and Web Services Manager, risking full system compromise with severe impact on data and availability.
“This Security Alert addresses vulnerability CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution.” reads the advisory.
“Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible. Oracle always recommends that customers remain on actively-supported versions and apply all Security Alerts and Critical Patch Update security patches without delay.”
The issue is labeled as “easily exploitable.”
The vulnerability impacts Oracle Web Services Manager and Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0.
Oracle did not reveal if the vulnerability was exploited in attacks in the wild.
In November 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle Fusion Middleware flaw, tracked as CVE-2025-61757 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.
The vulnerability is a missing authentication for a critical function that can result in pre-authenticated remote code execution. The flaw is easily exploitable and allows an unauthenticated attacker with HTTP network access to compromise Identity Manager, enabling a full takeover of the system.
The flaw impacts versions 12.2.1.4.0 and 14.1.2.1.0. Oracle addressed the flaw with the release of Oracle Critical Patch Update Advisory – October 2025.
Adam Kues and Shubham Shah of Assetnote reported the vulnerability.
SANS researcher Johannes B. Ullrich recently reported that an analysis of his organization’s honeypot logs revealed multiple HTTP POST attempts between August 30 and September 9, 2025, targeting the Oracle Identity Manager endpoint associated with CVE-2025-61757. The scans originated from different IPs but used the same user agent, suggesting a single attacker. The 556-byte POST payloads indicate likely exploitation as a zero-day, weeks before Oracle released a patch. Attempts came from 89.238.132[.]76, 185.245.82[.]81, and 138.199.29[.]153.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Oracle Identity Manager)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/189796/security/oracle-fixes-critical-rce-flaw-cve-2026-21992-in-identity-manager.html