InfoSecBulletin Cybersecurity for mankind
Oracle has put out a special security update to fix a serious flaw. This flaw allows anyone to run harmful code without needing an account. It affects Identity Manager and Web Services Manager, and it is known as CVE-2026-21992.
Oracle Identity Manager helps manage identities and access in a business, while Oracle Web Services Manager offers security and control for web services. In an advisory released yesterday, Oracle is “strongly” recommending that customers apply the patches as soon as possible.
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
“This Security Alert addresses vulnerability CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” reads the security advisory.
“Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible. Oracle always recommends that customers remain on actively-supported versions and apply all Security Alerts and Critical Patch Update security patches without delay.”
The CVE-2026-21992 vulnerability has a very high severity score of 9.8 and affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, plus Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0.
Oracle says the issue is simple to exploit from a distance using HTTP and does not need login or user action, which raises the risk for servers that are open.
The fix came out through the Security Alert program. This program gives quick fixes for serious problems that are being exploited. But Oracle says these patches work only for versions that have Premier or Extended Support. Older versions that have no support might still be at risk.
Oracle shared in a blog post today that CVE-2026-21992 is serious. They advised customers to check the security alert for full details and information on patches.
