Critical RCE Flaw in Oracle IAM (CVE-2026-21992)
Oracle warns that CVE-2026-21992 is a critical, unauthenticated HTTP remote-code-execution flaw affecting specific Oracle Identity Manager and Web Services Manager versions.
The Vulnerability
CVE-2026-21992 is a critical remote code execution vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. in Oracle Identity Manager and Oracle Web Services Manager. Oracle rates it CVSS 9.8 and confirms that an unauthenticated attacker with network access over HTTP can compromise affected systems. Oracle's public advisory does not disclose the underlying implementation flaw, so defenders should rely on the vendor's affected-version and patch guidance rather than unverified exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. details.
Who Is Affected
Oracle identifies Oracle Identity Manager and Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0 as affected. Organizations running either version should treat exposed HTTP interfaces as high priority and apply Oracle's Fusion Middleware patches or mitigations.
Immediate Actions Required
Apply the patches or mitigations in Oracle's Security Alert for CVE-2026-21992 as soon as possible. Until patching is complete, restrict network access to affected HTTP interfaces, inventory exposed systems, and review relevant access and application logs for suspicious activity. Enforce least-privilege controls to reduce the impact of a compromised service.
Technical Details
Oracle's public advisory confirms that the vulnerability is remotely exploitable without authentication over HTTP and can result in takeover of Oracle Identity Manager or Oracle Web Services Manager. The affected components are REST WebServices and Web Services Security. Oracle has not publicly documented the root cause in the advisory, so claims about a particular deserializationDeserialization🛡️The process of converting stored or transmitted data back into an object. Insecure deserialization can allow attackers to execute code by manipulating serialized data. or request-processing mechanism should not be treated as confirmed.
What This Means For You
Identity-management middleware is a high-impact target because compromise can affect authentication and access across connected systems. IT leaders should verify affected versions, apply Oracle's official patches, limit internet exposure, and monitor for suspicious activity. Continuous monitoring and rapid patching remain essential defenses for critical identity infrastructure.