Patch Now: Oracle's Fusion Middleware Has Critical RCE Flaw

Oracle issued an out-of-cycle security alert for CVE-2026-21992, a critical (CVSS 9.8) unauthenticated remote code execution flaw in Oracle Identity Manager and Oracle Web Services Manager that could allow attackers to manipulate identities, roles, and security policies or steal data; the bug affects specific OIM/OWSM versions used by many large enterprises, patching may be slow in complex environments, and while no public exploitation has been observed yet the potential impact and attackability are high.