Oracle Issues Urgent Security Update for Critical RCE Flaw in Identity Manager and Web Services Manager

Oracle issued an out-of-band Security Alert for CVE-2026-21992, a critical unauthenticated network-accessible remote code execution vulnerability (CVSS 3.1 base score 9.8) affecting Oracle Identity Manager and Oracle Web Services Manager (versions 12.2.1.4.0 and 14.1.2.1.0). The flaw resides in REST Web Services and Web Services Security components, can be exploited via HTTP with no authentication or user interaction, and Oracle strongly urges immediate patching and review of externally exposed endpoints to prevent full system compromise.