InfoSecBulletin Cybersecurity for mankind
Oracle has put out a special security update to fix a serious flaw. This flaw allows anyone to run harmful code without needing an account. It affects Identity Manager and Web Services Manager, and it is known as CVE-2026-21992.
Oracle Identity Manager helps manage identities and access in a business, while Oracle Web Services Manager offers security and control for web services. In an advisory released yesterday, Oracle is “strongly” recommending that customers apply the patches as soon as possible.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
“This Security Alert addresses vulnerability CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” reads the security advisory.
“Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible. Oracle always recommends that customers remain on actively-supported versions and apply all Security Alerts and Critical Patch Update security patches without delay.”
The CVE-2026-21992 vulnerability has a very high severity score of 9.8 and affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, plus Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0.
Oracle says the issue is simple to exploit from a distance using HTTP and does not need login or user action, which raises the risk for servers that are open.
The fix came out through the Security Alert program. This program gives quick fixes for serious problems that are being exploited. But Oracle says these patches work only for versions that have Premier or Extended Support. Older versions that have no support might still be at risk.
Oracle shared in a blog post today that CVE-2026-21992 is serious. They advised customers to check the security alert for full details and information on patches.
