9.8

CVSS Score

31st

OOB Alert Since 2010

2nd

OIM Emergency Patch

0

Auth Required

The Story

On March 19, 2026, Oracle published a Security Alert for CVE-2026-21992, a critical remote code execution vulnerability affecting Oracle Identity Manager (OIM) and Oracle Web Services Manager (OWSM). Both are core components of Oracle Fusion Middleware, deployed across large enterprises and government agencies for identity governance, user provisioning, and web services security.

The vulnerability is an unauthenticated RCE. An attacker with network access via HTTP can send a crafted request and achieve full system takeover. No credentials needed. No user interaction. Low attack complexity. Confidentiality, integrity, and availability all rated High. The NVD describes it as "easily exploitable." In Oracle Identity Manager, the flaw resides in the REST WebServices component. In Web Services Manager, it affects Web Services Security. Both products in versions 12.2.1.4.0 and 14.1.2.1.0 are impacted.

Oracle describes its Security Alerts as fixes "deemed too critical to wait for distribution in the next Critical Patch Update." The company has issued approximately 31 Security Alerts since 2010, averaging about two per year. The decision to release this outside the quarterly CPU cycle (next scheduled for April 2026) signals how seriously Oracle rates the risk. This is only the second out-of-band alert Oracle has ever issued for Identity Manager. The first was CVE-2017-10151, a CVSS 10.0 default account vulnerability.

The history here matters. In October 2025, Oracle patched CVE-2025-61757, another CVSS 9.8 unauthenticated RCE in the exact same product (Identity Manager), the same component (REST WebServices), and the same versions (12.2.1.4.0 and 14.1.2.1.0). Searchlight Cyber researchers described that flaw as "somewhat trivial and easily exploitable." By November 2025, CISA had added it to the Known Exploited Vulnerabilities catalog. SANS Institute researcher Johannes Ullrich reported that honeypot logs showed exploitation attempts targeting the associated endpoint as early as August 2025, weeks before Oracle released a patch, suggesting zero-day exploitation.

Oracle has not confirmed whether CVE-2026-21992 is being actively exploited. Oracle also has not confirmed whether the two CVEs are technically related, despite affecting the same product, component, and versions. SecurityWeek and Dark Reading both reached out to Oracle for comment. Oracle declined.

Tenable's Satnam Narang noted that Oracle Fusion Middleware has six vulnerabilities in CISA's KEV catalog, and Oracle has 42 total entries across all products. The pattern of critical pre-auth flaws in identity infrastructure components is not new for Oracle, but the frequency is accelerating.

The Adversary Perspective

From a red team standpoint, Oracle Identity Manager is one of the highest-value targets in any enterprise environment that runs it. OIM controls who has access to what across the entire organization. Compromising it means an attacker can create accounts, modify roles, escalate privileges, and provision access to any connected system, all through the platform's own legitimate functionality.

The attack surface is the REST WebServices endpoint. Any OIM instance with this endpoint reachable over HTTP or HTTPS is vulnerable to unauthenticated exploitation. In many enterprise deployments, OIM is accessible from internal networks and sometimes from partner networks or VPNs. It does not need to be internet-facing to be at risk, though any internet-exposed instances are in immediate danger.

The recurrence pattern is the real signal. Two CVSS 9.8 pre-auth RCEs in the same component within five months. The first was confirmed exploited in the wild. SANS caught exploitation attempts in honeypots before the patch was available. If you are an attacker who already has a working exploit for CVE-2025-61757, you are almost certainly evaluating whether CVE-2026-21992 is a variant, a bypass, or a net-new issue in adjacent code. Either way, the REST WebServices component of Oracle Identity Manager is clearly a soft target that has not been hardened at the architectural level.

The target demographics favor big game hunting. Oracle Identity Manager is deployed primarily by large enterprises, government agencies, and financial institutions. These are high-value targets for both nation-state espionage and ransomware operations. As Dark Reading noted, the average size of Oracle's customers makes this vulnerability particularly attractive to adversaries who focus on organizations where the data and disruption value justify significant investment in exploitation.

Figure 01

  1. STEP 01 // CRITICAL

    Unauthenticated RCE

    HTTP request to Oracle Identity Manager's REST WebServices endpoint or Oracle Web Services Manager's Web Services Security endpoint. No authentication. No user interaction. Arbitrary code execution on the underlying server. Full system takeover.
  2. STEP 02 // CRITICAL

    Identity Infrastructure Control

    With control of OIM, attacker can create new privileged accounts, modify existing user roles, provision access to any connected system. OIM manages identities across the entire enterprise. Compromise here is compromise everywhere.
  3. STEP 03

    Policy Manipulation via OWSM

    If Oracle Web Services Manager is compromised, attacker can modify or disable security policies governing API authentication, authorization, and encryption. This removes security controls from web services across the environment.
  4. STEP 04

    Lateral Movement via Legitimate Access

    New accounts created through OIM appear legitimate to every downstream system. Attacker moves laterally using provisioned credentials that pass every authentication and authorization check. No need for pass-the-hash or credential dumping.
  5. STEP 05

    Data Exfiltration & Persistence

    OIM contains a complete directory of every user, role, and entitlement in the enterprise. This data is valuable for targeting high-value accounts and understanding the organization's access structure. Persistence achieved through legitimately provisioned accounts that survive password resets and incident response.
  6. STEP 06 // CRITICAL

    Ransomware or Espionage Objective

    With identity infrastructure under attacker control, objectives range from mass encryption (ransomware, leveraging provisioned admin access) to long-term surveillance (espionage, creating dormant accounts for future reactivation). Attacker maintains access even if the original entry point is patched.

Vulnerability Details

  • CVE: CVE-2026-21992 (CVSS 9.8)
  • Affected Products: Oracle Identity Manager, Oracle Web Services Manager
  • Affected Versions: 12.2.1.4.0 and 14.1.2.1.0
  • Affected Components: REST WebServices (OIM), Web Services Security (OWSM)
  • Also Affected: Cisco Security Cloud Control (SCC) Firewall Management
  • Attack Vector: Network (HTTP/HTTPS), no authentication, no user interaction
  • Impact: Full system takeover (C:H / I:H / A:H)
  • Patch: Out-of-band Security Alert, March 19, 2026 (revised March 20)
  • Related CVE: CVE-2025-61757 (CVSS 9.8, same product/component/versions, CISA KEV Nov 2025)
  • Historical Precedent: CVE-2017-10151 (CVSS 10.0, only prior OIM OOB alert)
  • Prior Exploitation: SANS honeypots detected CVE-2025-61757 exploitation Aug-Sep 2025 (pre-patch)

Defensive Takeaways

  1. 1

    Apply the Out-of-Band Patch for CVE-2026-21992 Immediately

    Oracle explicitly stated this vulnerability was "deemed too critical to wait" for the April quarterly CPU. If your Oracle Identity Manager or Web Services Manager instances are unpatched, treat this as a P0 emergency. The predecessor flaw in the same component was confirmed exploited within weeks. Patches are available through Oracle's Patch Availability Document for Fusion Middleware. Only versions under Premier or Extended Support receive patches, so if you are running unsupported versions, upgrade immediately.

  2. 2

    Verify You Also Patched CVE-2025-61757 from October 2025

    The predecessor vulnerability in the same REST WebServices component was added to CISA's KEV catalog in November 2025. SANS detected exploitation attempts dating back to August 2025. If you did not apply the October 2025 patch, you have been vulnerable to a confirmed-exploited flaw for five months. Audit your Fusion Middleware environment for both CVEs. They affect the same product versions and the same component.

  3. 3

    Restrict Network Access to OIM and OWSM Management Endpoints

    Both CVE-2026-21992 and CVE-2025-61757 are exploitable via HTTP/HTTPS against REST WebServices endpoints. If these endpoints are accessible from broad network segments, your blast radius is maximized. Restrict access to OIM and OWSM management interfaces using firewall rules, network segmentation, or web application firewalls. Only allow access from designated administrative workstations. If any OIM endpoints are internet-facing, take them offline or place them behind an authenticated reverse proxy immediately.

  4. 4

    Audit OIM for Unauthorized Account Creation and Role Changes

    If CVE-2026-21992 or CVE-2025-61757 was exploited against your environment, the attacker's most valuable action would be creating new accounts or modifying existing roles through OIM's legitimate provisioning workflows. Review OIM audit logs for any account creation, role assignment, or entitlement changes that cannot be attributed to known administrative actions. Look especially for accounts created outside of normal business hours or provisioned with elevated privileges that do not match standard onboarding patterns.

  5. 5

    Monitor for HTTP POST Requests Targeting OIM REST Endpoints

    SANS honeypot data from the CVE-2025-61757 exploitation campaign showed 556-byte POST payloads targeting the Identity Manager endpoint from multiple IPs using the same user agent. Set up detection rules in your WAF, IDS, or SIEM for unusual HTTP POST activity targeting OIM REST WebServices paths. Baseline normal traffic patterns to these endpoints and alert on anomalies in volume, source IP, payload size, or user agent strings. Known scanning IPs from the CVE-2025-61757 campaign include 89.238.132.76, 185.245.82.81, and 138.199.29.153.