Oracle Critical Vulnerability in Web Services Manager and Identity Manager

CSA Alerts & Advisories (Singapore)

Published March 23rd, 2026

Detected March 23rd, 2026

Summary

The Cyber Security Agency of Singapore (CSA) has issued an alert regarding a critical vulnerability (CVE-2026-21992) in Oracle Web Services Manager and Identity Manager. The vulnerability allows for remote code execution and requires immediate security updates from users and administrators of affected versions.

View original document View source feed page

What changed

The Cyber Security Agency of Singapore (CSA) has issued an alert concerning a critical vulnerability, CVE-2026-21992, affecting Oracle Web Services Manager and Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. This vulnerability has a CVSSv3.1 score of 9.8 and can be exploited remotely over HTTP to bypass authentication and potentially execute arbitrary code on affected systems, posing a significant risk to enterprise identity management and web services infrastructure.

Users and administrators of the affected Oracle products are strongly advised to apply the latest security updates released by Oracle immediately to mitigate the risk of compromise. Failure to update could lead to unauthorized access and execution of malicious code on critical systems, impacting business operations and data security.

What to do next

Update Oracle Web Services Manager and Identity Manager to the latest versions immediately.

Source document (simplified)

Alerts

Critical Vulnerability in Oracle Products

23 March 2026

Oracle has released security updates to address a critical vulnerability in Oracle Web Services Manager and Identity Manager. Users and administrators of affected products are advised to update to the latest versions immediately.

Background

Oracle has released security updates to address a critical vulnerability (CVE-2026-21992) in Oracle Web Services Manager and Identity Manager. The vulnerability has a Common Vulnerability Scoring System (CVSSv3.1) score of 9.8 out of 10.

Impact

The critical vulnerability bypasses authentication through remote exploitation over HTTP with low complexity and no user interaction, making exposed enterprise identity management and web services infrastructure highly susceptible to immediate compromise. Successful exploitation could allow a remote unauthenticated attacker to perform arbitrary code execution on affected systems.

Affected Products

The vulnerability affects Oracle Web Services Manager and Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0.

Mitigation

Users and administrators of affected products are advised to update to the latest versions immediately.

References

https://www.oracle.com/security-alerts/alert-cve-2026-21992.html

https://nvd.nist.gov/vuln/detail/CVE-2026-21992

https://thehackernews.com/2026/03/oracle-patches-critical-cve-2026-21992.html