Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-61757 | Unauthenticated Takeover of Oracle Identity Manager via REST WebServices CVE-2025-61757 is a critical missing-authentication flaw (CWE-306) in the REST WebServices component of Oracle Identity Manager, part of Oracle Fusion Middleware, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access can send HTTP requests to the REST endpoints without any credentials or user interaction. Successful exploitation results in takeover of Identity Manager, with high-impact confidentiality, integrity, and availability consequences (CVSS 3.1 base score 9.8). Any organization running the affected versions of Oracle Identity Manager — typically large enterprises and public-sector organizations using it for identity and access management — is exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-21, news reports describe it as an actively exploited zero-day, and EPSS assigns an 88.3% probability of exploitation within 30 days. Do: Immediately apply Oracle's fix for CVE-2025-61757 to Identity Manager 12.2.1.4.0 and 14.1.2.1.0 per Oracle's security advisory (federal agencies must follow BOD 22-01 timelines). Until patching is complete, restrict untrusted and internet-facing HTTP access to the Identity Manager REST WebServices endpoints, and review logs for signs of compromise given confirmed in-the-wild exploitation. Also verify that the separate unauthenticated RCE in Identity Manager (CVE-2026-21992), which Oracle has patched, is remediated in the same maintenance cycle. | 9.8 | 88% | KEV |
| largeon the order of tens of thousands of enterprise deployments worldwide; the share with the REST endpoint exposed over HTTP is unknown | |
| CVE-2026-21992 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. Note: Oracle Web Services Manager is installed with an Oracle Fusion Middleware Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD description · AI analysis pending | 9.8 | 1% |
| — |
Full article319 words · extracted from helpnetsecurity.com · click to collapse
Oracle has released an out-of-band patch for a critical and easily exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager.
The company did not say whether the vulnerability has been exploited as a zero-day, but has urged customers to apply the updates or provided mitigations as soon as possible.
About CVE-2026-21992
CVE-2026-21992 is caused by missing authentication for a critical function.
In Oracle Identity Manager – a solution for provisioning, managing and deprovisioning users, roles, and access rights – CVE-2026-21992 affects the REST WebServices component.
In Oracle Web Services Manager, which is installed with an Oracle Fusion Middleware Infrastructure and is used for guarding the security of web services (APIs), CVE-2026-21992 affects the Web Services Security component.
In both cases, the vulnerability can be exploited by unauthenticated attackers over HTTP and HTTPS, to achieve remote code execution on vulnerable systems and take them over. No user interaction is needed for successful exploitation.
CVE-2026-21992 affects Oracle Identity Manager and Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0. Earlier, (now) unsupported versions are likely affected as well.
“As a result, Oracle recommends that customers upgrade to supported versions,” the company said.
Vulnerability mirrors actively exploited predecessor
In November 2025, a vulnerability in Oracle Identity Manager similar to CVE-2026-21992 was added by CISA to its Known Exploited Vulnerabilities catalog.
CVE-2025-61757 also stemmed from missing authentication for a critical function and was patched by Oracle in October 2025.
Assetnote / Searchlight Cyber researchers were credited with reporting it. They released a detailed techical write-up about it the day before CISA flagged the vulnerability as actively exploited.
It’s possible this report helped Oracle, other researchers, or even malicious attackers unearth CVE-2026-21992.
Whatever the case turns out to be, organizations using either or both solutions should apply the patch quickly.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/03/23/oracle-emergency-fix-cve-2026-21992/