CVE-2026-21992: Oracle Issues Emergency Patch for Critical Unauthenticated RCE in Identity Manager and Web Services Manager

CVE-2026-21992 affects two Oracle Fusion Middleware products that are central to enterprise identity and access management infrastructure. Oracle Identity Manager is used by large organisations to manage user identities, roles, access policies, and provisioning across enterprise systems — it is effectively the system that controls who has access to what across an organisation's entire technology stack. Oracle Web Services Manager provides the security and policy management layer for web services communications across Oracle Fusion Middleware deployments. A vulnerability in either product is high-value for attackers. In Oracle Identity Manager, the affected component is the REST WebServices interface. In Oracle Web Services Manager, the affected component is Web Services Security. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network accessible, low attack complexity, no privileges required, no user interaction, high impact across all three security categories. An attacker needs only HTTP access to an exposed endpoint and the ability to send a crafted network packet.

The implications of a successful exploit against Oracle Identity Manager are particularly severe because of what the product controls. An attacker who achieves RCE on an OIM server can manipulate the identities, roles, and access policies that govern the entire organisation — creating privileged accounts, escalating their own access, disabling security policies, and moving laterally across every system OIM manages. Against Oracle Web Services Manager, exploitation enables disabling or modifying the security policies governing web services communications — creating pathways for further attacks across the middleware stack. Oracle's customer base for these products skews heavily toward large enterprises, financial institutions, government agencies, and multinational corporations — exactly the organisations that ransomware groups and nation-state actors categorise as high-value targets. Oracle has issued only approximately 31 out-of-band Security Alerts across its entire history since 2010, averaging roughly two per year. The decision to release CVE-2026-21992 outside the quarterly cycle is itself a signal of severity. The context of CVE-2025-61757 — described by researchers as "somewhat trivial and easily exploitable" before it was actively exploited and added to CISA's KEV catalog — makes the urgency of patching CVE-2026-21992 even more acute. Both vulnerabilities affect the same product, the same component, and the same versions.