Oracle Patches Critical RCE Flaw in Identity Manager

Oracle released critical security patches on March 19, 2026, to address a severe vulnerability in its Fusion Middleware components that allows unauthenticated attackers to execute remote code on affected systems. The flaw, identified as CVE-2026-21992, affects Oracle Identity Manager and Oracle Web Services Manager, tools widely used by enterprises for identity governance and web services security.

The vulnerability carries a CVSS 3.1 base score of 9.8 out of 10, classifying it as critical due to its high potential impact on confidentiality, integrity, and availability. It enables remote code execution over HTTP without requiring authentication, user interaction, or special privileges, making it exploitable by anyone with network access to the affected endpoints. In Oracle Identity Manager, the issue resides in the REST Web Services component, while in Oracle Web Services Manager, it stems from the Web Services Security module. The flaw impacts versions 12.2.1.4.0 and 14.1.2.1.0 of both products. Oracle updated its security alert on March 20, 2026, providing detailed patch instructions through its My Oracle Support portal and advisory page.

"This vulnerability is remotely...