Unauthenticated Remote Code Execution Vulnerability in Oracle Identity Manager and Oracle Web Services Manager
CVE-2026-21992

9.8CRITICAL

Key Information:

Vendor

Oracle
Status
Oracle Identity Manager
Oracle Web Services Manager
Vendor
CVE Published:
20 March 2026

What is CVE-2026-21992?

An exploitable vulnerability exists in Oracle Identity Manager and Oracle Web Services Manager within the REST WebServices and Web Services Security components. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to compromise affected systems. If successfully executed, this vulnerability allows attackers to take control of Oracle Identity Manager and Oracle Web Services Manager, creating significant risks for data confidentiality, integrity, and availability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Oracle Identity Manager 12.2.1.4.0

Oracle Identity Manager 14.1.2.1.0

Oracle Web Services Manager 12.2.1.4.0

References

https://www.oracle.com/security-alerts/alert-cve-2026-219...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.