Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager
Summary: Oracle released security updates for a critical flaw in Identity Manager and Web Services Manager tracked as CVE-2026-21992 with a CVSS score of 9.8 out of 10.0, which Oracle says is remotely exploitable without authentication and may result in remote code execution. NIST's National Vulnerability Database describes the flaw as easily exploitable by an unauthenticated attacker with network access via HTTP, potentially allowing takeover of susceptible instances, and Oracle makes no mention of exploitation in the wild while urging customers to apply the update without delay.
What you should know: This is the same product class CISA added to its Known Exploited Vulnerabilities catalog in November 2025 with CVE-2025-61757, another 9.8 pre-authenticated RCE in Oracle Identity Manager cited with evidence of active exploitation - so an unauthenticated, network-reachable 9.8 in the identity layer is a pattern, not a one-off.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-61757CVE-2026-21992
- Related
- CVE-2025-61757: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Nov 21, 2025