Oracle issues out-of-band fix for CVE-2026-21992 in Identity Manager (CVSS 9.8)
Oracle's Security Alert for CVE-2026-21992 fixes a 9.8 unauthenticated RCE in Identity Manager and Web Services Manager 12.2.1.4.0 and 14.1.2.1.0. Patch steps.
On 19 March 2026, Oracle released a Security Alert, outside its quarterly Critical Patch Update cycle, for CVE-2026-21992. It is an unauthenticated remote code execution flaw in Oracle Identity Manager (OIM) and Oracle Web Services Manager (OWSM), scored CVSS 9.8. Oracle uses Security Alerts for fixes it considers too critical to wait for the next quarterly update. Identity governance systems hold provisioning rights to most other systems in an enterprise, so this deserves emergency patching.
What happened
Oracle's alert (rev 1 on 19 March, with a note added on 20 March) says the vulnerability is remotely exploitable over HTTP without authentication and may lead to remote code execution. The vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: low complexity, no privileges and no user interaction needed. Oracle has not published technical details and has not said whether the flaw is being exploited. Tenable noted that no public proof-of-concept existed when it wrote its analysis.
There is relevant history here. CVE-2025-61757, an authentication bypass in the same OIM REST WebServices component, was exploited in the wild and added to CISA's KEV catalog on 21 November 2025. Oracle has not said whether the two bugs are related.
Who is affected
- Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, in the REST WebServices component.
- Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.1.0, in the Web Services Security component. OWSM is installed as part of Oracle Fusion Middleware Infrastructure, so it may be present even if nobody on the team thinks of it as a product they run.
- Older, unsupported releases. Oracle says Security Alert patches are produced only for versions under Premier or Extended Support and that earlier versions are likely affected.
What it means for developers and engineering teams
An identity governance platform is a privileged hub. OIM connects to directories, databases, HR systems and applications so it can create, change and remove accounts, which means it holds service credentials for all of them. Pre-auth code execution on OIM gives an attacker those connector credentials and the ability to provision accounts anywhere OIM reaches. Blast radius is the right lens here: compromising the system that manages identities is compromising every system it manages.
The weak spot is the REST API layer. Two critical bugs in the same OIM REST component within four months suggest that the API surface added to older middleware deserves extra scrutiny. That applies to your own services too: authentication filters that depend on URL pattern matching, and REST endpoints added after the original security review, are where bypasses tend to appear.
Patch cadence matters too. Oracle normally ships fixes in quarterly Critical Patch Updates (January, April, July and October). Teams that only schedule Oracle maintenance around those dates need a process for out-of-band Security Alerts like this one: a named owner, a test environment that can take a patch within days, and a rollback plan.
OWSM's presence in Fusion Middleware Infrastructure is a reminder that a software bill of materials matters for commercial stacks, not only open-source dependencies. Teams running WebLogic-based applications should check whether they have OWSM installed.
What to do now
- Identify exposure: list OIM and Fusion Middleware Infrastructure installations, including OWSM, and record their exact versions.
- Apply the patches listed in My Oracle Support note KB878741 (the Security Alert patch availability document).
- Restrict network access to OIM and OWSM REST and web services endpoints, keeping them internal-only or behind an authenticating reverse proxy or WAF until patched.
- Hunt for compromise: review access logs for unusual unauthenticated requests to OIM REST paths, look for unexpected processes started by the WebLogic server user, and check for new or changed accounts provisioned by OIM.
- Rotate connector credentials held by OIM if you find signs of compromise.
- Plan an upgrade for any release outside Premier or Extended Support, because those versions won't receive fixes.