Oracle on Friday issued out-of-band updates to patch a critical vulnerability affecting its Identity Manager and Web Services Manager products.
Oracle Identity Manager is an enterprise identity governance platform that automates user provisioning, deprovisioning, and access management across applications and systems. Oracle Web Services Manager is a policy-driven framework for managing and protecting web services.
Oracle revealed that the products, part of the Fusion Middleware suite, are affected by CVE-2026-21992, a critical vulnerability that can be exploited by an unauthenticated attacker for remote code execution.
According to Oracle’s advisory, the vulnerability has a CVSS score of 9.8 and it affects the REST WebServices component of Identity Manager and the Web Services Security component of Web Services Manager.
“Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager,” reads the description of CVE-2026-21992 in the National Vulnerability Database. “Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager.”
Oracle’s Integrated Cyber Center has published a security alert to draw organizations’ attention to the patches, but the vendor has not clearly stated whether the flaw has been exploited in the wild.
SecurityWeek has reached out to Oracle to find out whether the vulnerability has been leveraged in malicious attacks.
It’s worth noting that it would not be the first time Oracle has released a patch for a zero-day without specifically telling customers that it has been exploited in the wild.
In November 2025, the software giant informed customers about another critical pre-authentication remote code execution vulnerability in Identity Manager. The company did not mention exploitation, but others later confirmed that it had been exploited as a zero-day.
Vulnerabilities in Oracle’s E-Business Suite (EBS) were recently exploited in a massive data theft campaign that affected more than 100 organizations. The attacks involved the exploitation of zero-days, but Oracle has not clearly specified which flaws the attackers used.
Related: Oracle EBS Hack: Only 4 Corporate Giants Still Silent on Potential Impact
Related: Michelin Confirms Data Breach Linked to Oracle EBS Attack
Related: Oracle’s First 2026 CPU Delivers 337 New Security Patches
