Oracle Identity Manager and Web Services Manager Vulnerability

CERT-FR Security Advisories

Published March 20th, 2026

Detected March 20th, 2026

Summary

CERT-FR has issued a security advisory regarding a critical vulnerability in Oracle Identity Manager and Web Services Manager. The vulnerability, identified as CVE-2026-21992, allows for remote arbitrary code execution. Affected versions require immediate patching.

View original document View source feed page

What changed

CERT-FR has issued an advisory (CERTFR-2026-AVI-0332) detailing a critical vulnerability (CVE-2026-21992) affecting Oracle Identity Manager and Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0 that have not applied the latest security patches. This vulnerability poses a significant risk as it enables remote arbitrary code execution.

Organizations utilizing the affected Oracle products must consult Oracle's security bulletin and apply the necessary patches immediately to mitigate the risk of exploitation. Failure to do so could result in unauthorized access and control over critical systems, leading to data breaches or operational disruption.

What to do next

Apply security patches for Oracle Identity Manager and Web Services Manager as per Oracle's security bulletin.
Consult Oracle's security bulletin (alert-cve-2026-21992) for detailed remediation steps.
Review system logs for any signs of compromise related to CVE-2026-21992.

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 20 mars 2026 N° CERTFR-2026-AVI-0332 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Vulnérabilité dans Oracle Identity Manager et Web Services Manager

Gestion du document

Risque

Exécution de code arbitraire à distance

Systèmes affectés

Identity Manager version 12.2.1.4.0 sans le dernier correctif de sécurité
Identity Manager version 14.1.2.1.0 sans le dernier correctif de sécurité
Web Services Manager version 12.2.1.4.0 sans le dernier correctif de sécurité
Web Services Manager version 14.1.2.1.0 sans le dernier correctif de sécurité

Résumé

Une vulnérabilité a été découverte dans Oracle Identity Manager et Web Services Manager. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.