Oracle Identity Manager Connector Flaws Expose Critical Data to Unauthenticated Attackers

Oracle issued an out-of-band Security Alert for `CVE-2026-21992`, a critical unauthenticated remote code execution flaw affecting Oracle Fusion Middleware deployments that use Oracle Identity Manager and Oracle Web Services Manager. The vulnerability carries a CVSS 3.1 score of **9.8** and can be exploited remotely over the network with low complexity and no user interaction, raising particular concern for internet-facing systems. Oracle said the flaw affects the REST Web Services component in Oracle Identity Manager and the Web Services Security module in Oracle Web Services Manager. Successful exploitation could result in full system compromise, including credential theft and lateral movement, and the company urged customers to apply available patches immediately. Oracle also warned that organizations running unsupported versions should upgrade to supported releases, as fixes are only provided under Premier Support or Extended Support.

Mar 20, 2026

Oracle Critical Patch Update Fixes High-Severity Flaws in Enterprise Manager, Identity Manager, and PeopleTools

Oracle disclosed three high-severity vulnerabilities affecting core enterprise products in its Critical Patch Update advisory. **CVE-2026-34279** impacts the Event Management component of Oracle Enterprise Manager Base Platform versions `13.5` and `24.1` and is rated `CVSS 9.1`; Oracle said a high-privileged attacker with network access over HTTP could exploit the flaw to take over the platform, with potential impact extending to additional products because of a scope change. **CVE-2026-34286**, also rated `CVSS 9.1`, affects the Core component of Oracle Identity Manager Connector in Oracle Fusion Middleware version `12.2.1.4.0` and can be exploited by an unauthenticated attacker over HTTPS. Oracle also reported **CVE-2026-34309** in the Security component of PeopleSoft Enterprise PeopleTools versions `8.61` through `8.62`, assigning it a `CVSS 8.1` score. The flaw is described as easily exploitable by a low-privileged attacker with network access over HTTP and could allow unauthorized creation, deletion, or modification of critical data, along with access to sensitive or complete accessible data. Across the three disclosures, Oracle warned that successful exploitation could result in platform compromise, data tampering, and broad unauthorized access in widely deployed enterprise management and identity systems.

Apr 21, 2026

Critical RCE Vulnerability in Oracle Fusion Middleware (CVE-2025-61757)

A critical vulnerability, CVE-2025-61757, has been identified in Oracle Fusion Middleware's Identity Manager component, allowing remote, unauthenticated attackers to achieve arbitrary remote code execution. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation and urging all organizations, especially those in the federal sector, to prioritize remediation. The affected versions include Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, and exploitation could result in complete system compromise. Security researchers recommend immediate upgrades to patched versions to mitigate risk. Tools such as runZero can assist organizations in identifying vulnerable Oracle Identity Manager installations using queries like `vendor:="Oracle" product:="Identity Manager"`. CISA's Binding Operational Directive 22-01 mandates federal agencies to remediate KEV-listed vulnerabilities by specified deadlines, but all organizations are strongly encouraged to address this critical issue promptly to reduce exposure to active threats.

Nov 21, 2025

Oracle Identity Manager Connector Flaws Expose Critical Data to Unauthenticated Attackers

How this story unfolded

Oracle discloses three critical Oracle Identity Manager Connector flaws

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Oracle Identity Manager Connector Flaws Expose Critical Data to Unauthenticated Attackers

How this story unfolded

Oracle discloses three critical Oracle Identity Manager Connector flaws

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Oracle Identity Manager Connector Flaws Expose Critical Data to Unauthenticated Attackers

How this story unfolded

Oracle discloses three critical Oracle Identity Manager Connector flaws

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Oracle Warns of Critical Unauthenticated RCE in Identity Manager and Web Services Manager

Oracle Critical Patch Update Fixes High-Severity Flaws in Enterprise Manager, Identity Manager, and PeopleTools

Critical RCE Vulnerability in Oracle Fusion Middleware (CVE-2025-61757)

Oracle Identity Manager Connector Flaws Expose Critical Data to Unauthenticated Attackers

How this story unfolded

Oracle discloses three critical Oracle Identity Manager Connector flaws

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Oracle Warns of Critical Unauthenticated RCE in Identity Manager and Web Services Manager

Oracle Critical Patch Update Fixes High-Severity Flaws in Enterprise Manager, Identity Manager, and PeopleTools

Critical RCE Vulnerability in Oracle Fusion Middleware (CVE-2025-61757)