Oracle Warns of Critical Unauthenticated RCE in Identity Manager and Web Services Manager

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Unauthenticated RCE in Oracle Identity Manager and Oracle Web Services Manager (CVE-2026-21992)

Affected products

1 linked

Oracle Identity Manager

Observables

3 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

8 references tracked. Mallory keeps watching after this page renders.

Thecyberexpress Com VulnerabilitiesNews · Mar 24, 2026

Oracle Identity Manager Patch For CVE‑2026‑21992Open source ↗

Help Net SecurityNews · Mar 23, 2026

Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992) - Help Net SecurityOpen source ↗

Belgium Ccb Security AdvisoriesNews · Mar 23, 2026

Warning: Critical vulnerability in Oracle Identity Manager and Oracle Web Services Manager. Patch Immediately! | CCB SafeonwebOpen source ↗

Security AffairsNews · Mar 22, 2026

Oracle fixes critical RCE flaw CVE-2026-21992 in Identity ManagerOpen source ↗

CyberthroneNews · Mar 22, 2026

Oracle Patches CVE-2026-21992 - Unauthenticated RCE - TheCyberThroneOpen source ↗

The Hacker NewsNews · Mar 21, 2026

Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity ManagerOpen source ↗

Cyber Security NewsNews · Mar 21, 2026

Oracle Issues Urgent Security Update for Critical RCE Flaw in Identity Manager and Web Services ManagerOpen source ↗

Oracle Product AdvisoriesNews · Mar 18, 2026

Oracle Security Alert Advisory - CVE-2026-21992Open source ↗

On the same thread

A critical vulnerability in Oracle Identity Manager, identified as CVE-2025-61757 and rated 9.8 on the CVSS scale, is being actively exploited by threat actors. The flaw affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, allowing unauthenticated attackers to remotely execute code via the Oracle REST Web Services component. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings about ongoing exploitation, and researchers from Searchlight Cyber have detailed how attackers can bypass authentication by appending specific strings such as `?WSDL` or `;.wadl` to REST endpoints. Organizations using affected Oracle Identity Manager versions are urged to apply the vendor's recent patches immediately to mitigate the risk of compromise. The vulnerability's active exploitation highlights the importance of timely patch management and monitoring for unusual activity on exposed Oracle REST Web Services endpoints. Security teams should review their systems for signs of unauthorized access and ensure that all mitigations recommended by Oracle and CISA are implemented without delay.

Nov 27, 2025

Critical RCE Vulnerability in Oracle Fusion Middleware (CVE-2025-61757)

A critical vulnerability, CVE-2025-61757, has been identified in Oracle Fusion Middleware's Identity Manager component, allowing remote, unauthenticated attackers to achieve arbitrary remote code execution. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation and urging all organizations, especially those in the federal sector, to prioritize remediation. The affected versions include Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, and exploitation could result in complete system compromise. Security researchers recommend immediate upgrades to patched versions to mitigate risk. Tools such as runZero can assist organizations in identifying vulnerable Oracle Identity Manager installations using queries like `vendor:="Oracle" product:="Identity Manager"`. CISA's Binding Operational Directive 22-01 mandates federal agencies to remediate KEV-listed vulnerabilities by specified deadlines, but all organizations are strongly encouraged to address this critical issue promptly to reduce exposure to active threats.

Nov 21, 2025

Oracle Identity Manager Connector Flaws Expose Critical Data to Unauthenticated Attackers

Oracle disclosed three high-severity vulnerabilities in the Oracle Identity Manager Connector component of Oracle Fusion Middleware, tracked as **`CVE-2026-34285`**, **`CVE-2026-34286`**, and **`CVE-2026-34287`**. The flaws affect supported version **`12.2.1.4.0`** and are described as easily exploitable by unauthenticated attackers with network access over **HTTPS**, including issues in the product's **Core** component. Successful exploitation could allow attackers to create, delete, or modify critical data and gain unauthorized access to sensitive information, including potentially complete access to all data reachable through the Oracle Identity Manager Connector. Oracle assigned each vulnerability a **CVSS v3.1 score of 9.1**, citing high confidentiality and integrity impact with no availability impact, and referenced the issues in its **Critical Patch Update** advisory.

Apr 21, 2026

Oracle Warns of Critical Unauthenticated RCE in Identity Manager and Web Services Manager

How this story unfolded

Oracle revises the CVE-2026-21992 security alert

Oracle releases security alert for CVE-2026-21992

Related entities

Vulnerabilities

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Oracle Warns of Critical Unauthenticated RCE in Identity Manager and Web Services Manager

How this story unfolded

Oracle revises the CVE-2026-21992 security alert

Oracle releases security alert for CVE-2026-21992

Related entities

Vulnerabilities

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Oracle Warns of Critical Unauthenticated RCE in Identity Manager and Web Services Manager

How this story unfolded

Oracle revises the CVE-2026-21992 security alert

Oracle releases security alert for CVE-2026-21992

Related entities

Vulnerabilities

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Active Exploitation of Critical Oracle Identity Manager Vulnerability

Critical RCE Vulnerability in Oracle Fusion Middleware (CVE-2025-61757)

Oracle Identity Manager Connector Flaws Expose Critical Data to Unauthenticated Attackers

Oracle Warns of Critical Unauthenticated RCE in Identity Manager and Web Services Manager

How this story unfolded

Oracle revises the CVE-2026-21992 security alert

Oracle releases security alert for CVE-2026-21992

Related entities

Vulnerabilities

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Active Exploitation of Critical Oracle Identity Manager Vulnerability

Critical RCE Vulnerability in Oracle Fusion Middleware (CVE-2025-61757)

Oracle Identity Manager Connector Flaws Expose Critical Data to Unauthenticated Attackers