Loading vulnerability…
Unauthenticated RCE in Oracle Identity Manager and Oracle Web Services Manager
CVE-2026-21992 is an unauthenticated remote code execution vulnerability affecting the REST WebServices component of Oracle Identity Manager and the Web Services Security component of Oracle Web Services Manager in Oracle Fusion Middleware. Supported affected versions of both products are 12.2.1.4.0 and 14.1.2.1.0. An attacker with HTTP network access to a vulnerable service can exploit the flaw to take over affected instances without credentials or user interaction. Oracle Web Services Manager is installed with Oracle Fusion Middleware Infrastructure. Missing authentication for a critical function is a reported weakness; a separate technical account describes unsafe Java deserialization, but the precise root cause and vulnerable processing path are not conclusively established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution and takeover of affected Oracle Identity Manager or Oracle Web Services Manager instances. Potential consequences include credential or other sensitive-data theft, manipulation of identities and roles, alteration or disabling of web-service security policies, and service disruption. Compromise of these identity and security-management components may also facilitate privilege escalation and lateral movement into connected systems; those broader consequences depend on deployment permissions and trust relationships.
If you can’t patch tonight, do this now.
If patching is delayed, restrict network access to affected REST WebServices and Web Services Security endpoints and remove unnecessary public HTTP/HTTPS exposure. Apply appropriate WAF controls as defense in depth, without treating them as a substitute for patching. Review exposure of associated WebLogic services and management interfaces and follow Oracle's applicable mitigation guidance.
Patch, then assume compromise.
Apply Oracle's out-of-band security updates for CVE-2026-21992 to affected Oracle Identity Manager and Oracle Web Services Manager installations without delay, prioritizing externally accessible deployments. Updates were issued through the March 19, 2026 Security Alert. Patches are available for releases covered by Premier Support or Extended Support. Upgrade unsupported installations to supported releases and apply the applicable updates; earlier unsupported versions may also be affected.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
121 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.