Do Son 
Oracle has issued an urgent security alert following the discovery of a “Critical” rated vulnerability impacting its Fusion Middleware ecosystem. The flaw, tracked as CVE-2026-21992, carries a CVSS score of 9.8, signaling a severe risk to identity and access management infrastructure worldwide.
The vulnerability targets the core of enterprise security, specifically impacting Oracle Identity Manager and Oracle Web Services Manager. Because these components are responsible for governing user identities and securing web services, a compromise could grant an attacker total control over a company’s digital gates.
What makes CVE-2026-21992 particularly dangerous is its ease of exploitation. The flaw resides within the REST WebServices and Web Services Security components. An unauthenticated attacker with simple network access via HTTP can exploit this weakness without any prior credentials or user interaction.
“Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager”.
The “9.8” score reflects a total compromise of the three pillars of security: Confidentiality, Integrity, and Availability. In a successful attack, the adversary effectively becomes the administrator, gaining the ability to view sensitive data, modify identity records, or shut down critical services entirely.
The vulnerability is confirmed to affect supported versions 12.2.1.4.0 and 14.1.2.1.0 of both products. Oracle also reminds administrators that Oracle Web Services Manager is automatically installed with any Oracle Fusion Middleware Infrastructure, meaning the attack surface may be broader than initially expected.
Oracle is strongly urging customers to apply the provided updates or mitigations without delay. Given the “easily exploitable” nature of the flaw and the high value of the targeted systems, unpatched instances are considered sitting ducks for automated scanners and state-sponsored actors alike.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
