Skip to content

CVE-2026-21992 - Critical Remote Code Execution in Oracle Identity Manager

alt text

Oracle Middleware Pre-Auth RCE Critical Vulnerability

Overview

CVE-2026-21992 is a critical pre-authentication remote code execution vulnerability affecting Oracle Identity Manager and Oracle Web Services Manager.

An unauthenticated attacker can send specially crafted HTTP requests to vulnerable services and execute arbitrary code on the target server, making this issue highly exploitable.

Technical Specifications

Field Details
Identifier CVE-2026-21992
Vulnerability Type Pre-auth remote code execution (RCE)
CVSS Score 9.8 (Critical)
Attack Vector Network (HTTP), no authentication required
Affected Products Oracle Identity Manager / Oracle Web Services Manager
Affected Versions 12.2.1.4.0 and 14.1.2.1.0

Affected Products

  • Oracle Identity Manager 12.2.1.4.0
  • Oracle Identity Manager 14.1.2.1.0
  • Oracle Web Services Manager 12.2.1.4.0
  • Oracle Web Services Manager 14.1.2.1.0

Technical Details

  • The flaw is exposed over HTTP and can be triggered remotely without credentials.
  • Improper request handling allows crafted input to reach dangerous execution paths.
  • Attackers can deliver commands or payloads directly to vulnerable server processes.
  • Successful exploitation can provide high-privilege execution on middleware hosts.
  • A compromised IAM/middleware node can become a strategic pivot point inside enterprise networks.

Attack Scenario

  1. An attacker identifies an internet-facing or reachable Oracle Identity Manager/Web Services Manager instance.
  2. The attacker sends a crafted HTTP request targeting the vulnerable input-processing logic.
  3. The server processes malicious input and executes attacker-controlled code.
  4. The attacker gains control of the affected host and may deploy persistence.
  5. The compromised server is used to access sensitive identity data or pivot laterally.

Impact Assessment

Successful exploitation can lead to full compromise of affected Oracle middleware servers.

Attackers may gain access to sensitive enterprise identity data and related management workflows.

A compromised middleware host can be leveraged for lateral movement and wider internal network compromise.

Mitigation Strategies

  • Apply Oracle security patches for CVE-2026-21992 immediately.
  • Restrict external exposure of Oracle Identity Manager and Web Services Manager interfaces.
  • Monitor HTTP traffic and system telemetry for unusual requests or post-exploitation activity.
  • Enforce Oracle-recommended hardening baselines for middleware deployments.
  • Review privileged service accounts and segmentation controls around IAM infrastructure.

Resources

Open-Source Reporting

Last Updated: March 26, 2026