CVE-2026-21992: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-21992 is a critical unauthenticated remote code execution (RCE) vulnerability affecting Oracle Identity Manager (REST WebServices component) and Oracle Web Services Manager (Web Services Security component), both part of Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. Oracle disclosed and patched this vulnerability via an out-of-band Security Alert on March 19–20, 2026, indicating the severity warranted immediate action outside the regular Critical Patch Update cycle. It carries a CVSS v3.1 base score of 9.8 (Critical) (Oracle Advisory, Feedly).

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), meaning critical REST WebServices and Web Services Security endpoints in Oracle Identity Manager and Oracle Web Services Manager can be accessed without any authentication. An unauthenticated attacker with network access via HTTP can send crafted requests to these exposed endpoints to achieve full system compromise. No user interaction or elevated privileges are required, and attack complexity is low, making this trivially exploitable from any network-accessible position. Oracle Web Services Manager is installed as part of Oracle Fusion Middleware Infrastructure, broadening the attack surface (Oracle Advisory, Tenable Blog, Security Boulevard).

Successful exploitation allows an unauthenticated remote attacker to achieve complete takeover of Oracle Identity Manager and Oracle Web Services Manager, with high impact to confidentiality, integrity, and availability. Because Oracle Identity Manager is a core identity governance platform, compromise can expose sensitive user credentials, role assignments, and provisioning data across the enterprise, enabling lateral movement to connected systems. An attacker could read sensitive data, modify system configuration and user accounts, disrupt service availability, and potentially pivot to other integrated enterprise applications (Oracle Advisory, Tenable Blog).

A GitHub repository (TEXploited/CVE-2026-21992) was identified as a potential PoC, but Feedly's analysis assessed it as empty/non-functional with no real exploit code confirmed (Feedly). Exploitation has been reported by multiple sources including thecyberthrone.in, and the vulnerability's trivial exploitation conditions (no auth, low complexity, network-accessible) make it highly attractive to threat actors. The EPSS score is approximately 0.043%, though the critical CVSS score and out-of-band patch release signal Oracle's assessment of high real-world risk. Detection plugins are available from Nessus (plugin 303226) and Qualys (plugin 386921). No specific threat actor attribution or CISA KEV listing was confirmed for this CVE at time of reporting (Feedly, Tenable Nessus).

1. Reconnaissance: Identify internet-facing Oracle Fusion Middleware deployments running Oracle Identity Manager or Oracle Web Services Manager versions 12.2.1.4.0 or 14.1.2.1.0 using tools like Shodan, Censys, or network scanning targeting default OIM/OWS ports (typically 7001/7002 for WebLogic-hosted services).
2. Identify unauthenticated endpoints: Enumerate REST WebServices endpoints exposed by Oracle Identity Manager (e.g., /iam/governance/selfservice/api/ or similar REST API paths) and Web Services Security endpoints in Oracle Web Services Manager that lack authentication enforcement due to CWE-306.
3. Craft malicious HTTP request: Send a specially crafted HTTP request to the vulnerable unauthenticated endpoint. The request exploits the missing authentication check to reach a critical function that processes attacker-controlled input.
4. Achieve remote code execution: The malicious payload is processed server-side, resulting in arbitrary code execution under the application server's service account (typically the Oracle WebLogic or Fusion Middleware process user).
5. Post-exploitation: With code execution, establish persistence (e.g., web shell, reverse shell), exfiltrate identity data (user accounts, roles, credentials), or pivot laterally to systems integrated with Oracle Identity Manager (Oracle Advisory, Tenable Blog).

• Network: Unexpected or anomalous HTTP/HTTPS requests to Oracle Identity Manager REST API endpoints (e.g., /iam/governance/) or Oracle Web Services Manager security endpoints from external or untrusted IP addresses; outbound connections from the Fusion Middleware server to unknown external hosts.
• Logs: Oracle Identity Manager and WebLogic access logs showing unauthenticated requests to REST WebServices endpoints returning unexpected 200 responses; error logs showing unusual Java exceptions or class loading activity; WebLogic server logs indicating unexpected process spawning.
• File System: Presence of unexpected JSP web shells, scripts, or binaries in the Oracle Fusion Middleware deployment directories (e.g., $ORACLE_HOME/user_projects/domains/); new or modified configuration files in the OIM or OWS installation paths.
• Process: Unusual child processes spawned by the WebLogic Java process (e.g., cmd.exe, /bin/bash, curl, wget, python); unexpected scheduled tasks or cron jobs created under the Fusion Middleware service account.
• Authentication/Identity: Unexpected new user accounts, role assignments, or privilege escalations within Oracle Identity Manager; bulk export or access of identity data outside normal business hours (Oracle Advisory, Tenable Blog).

Oracle released patches for both affected versions (12.2.1.4.0 and 14.1.2.1.0) via an out-of-band Security Alert on March 19–20, 2026; patch details are available in the Fusion Middleware Patch Availability Document linked from the Oracle advisory. Organizations should apply these patches immediately, prioritizing internet-facing deployments. As interim mitigations, restrict network access to Oracle Identity Manager and Oracle Web Services Manager HTTP endpoints to trusted networks and hosts only, and implement network segmentation to limit exposure of these components. Monitoring for exploitation attempts against REST WebServices and Web Services Security endpoints is also recommended (Oracle Advisory, Feedly).

The out-of-band nature of Oracle's patch release — outside the regular quarterly Critical Patch Update cycle — drew significant attention from the security community, with coverage from SecurityWeek, Heise, BleepingComputer, Help Net Security, and Security Affairs highlighting the urgency. Tenable published a dedicated blog post and Sophos issued a vulnerability impact analysis, both emphasizing the trivial exploitability and critical risk to enterprise identity infrastructure (SecurityWeek, Tenable Blog, Sophos Blog). National CERTs including Canada (CCCS), Belgium (CCB), New Zealand (NCSC), Hong Kong (GovCERT), and Australia (WA SOC) issued advisories urging immediate patching. Reddit communities (r/sysadmin, r/blueteamsec, r/SecOpsDaily) actively discussed the vulnerability, with commentary noting that the emergency patch underscores broader concerns about authentication gaps in enterprise middleware (Canadian Advisory, Help Net Security).