Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager

Source: The Hacker News
Published: Sat, 21 Mar 2026 10:24:00 GMT

Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be exploited to achieve remote code execution.

The vulnerability, tracked as CVE-2026-21992 , carries a CVSS score of 9.8 out of a maximum of 10.0.

"This vulnerability is remotely exploitable without authentication," Oracle said in an advisory. "If successfully exploited, this vulnerability may result in remote code execution."

CVE-2026-21992 affects the following versions -

According to a description of the flaw in the NIST National Vulnerability Database (NVD), it's "easily exploitable" and could allow an unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. This, in turn, can result in the successful takeover of susceptible instances.

Oracle makes no mention of the vulnerability being exploited in the wild. However, the tech giant has urged customers to apply the update without delay for optimal protection.

In November 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-61757 (CVSS score: 9.8), a pre-authenticated remote code execution flaw impacting Oracle Identity Manager, to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

A practical deep dive into securing AI agents against real-world attack paths beyond the model itself.

See exactly where your controls stand against today’s threats—automated, accurate, approachable.

Get the latest news, expert insights, exclusive resources, and strategies from industry leaders – all for free.

Source

Original report: https://thehackernews.com/2026/03/oracle-patches-critical-cve-2026-21992.html