Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager

Ravie LakshmananMar 21, 2026Vulnerability / Threat Intelligence

Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be exploited to achieve remote code execution.

The vulnerability, tracked as CVE-2026-21992, carries a CVSS score of 9.8 out of a maximum of 10.0.

“This vulnerability is remotely exploitable without authentication,” Oracle said in an advisory. “If successfully exploited, this vulnerability may result in remote code execution.”

CVE-2026-21992 affects the following versions –

• Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0
• Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0

According to a description of the flaw in the NIST National Vulnerability Database (NVD), it’s “easily exploitable” and could allow an unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. This, in turn, can result in the successful takeover of susceptible instances.

Oracle makes no mention of the vulnerability being exploited in the wild. However, the tech giant has urged customers to apply the update without delay for optimal protection.

In November 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-61757 (CVSS score: 9.8), a pre-authenticated remote code execution flaw impacting Oracle Identity Manager, to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.