InfoSecBulletin Cybersecurity for mankind
Oracle has put out a special security update to fix a serious flaw. This flaw allows anyone to run harmful code without needing an account. It affects Identity Manager and Web Services Manager, and it is known as CVE-2026-21992.
Oracle Identity Manager helps manage identities and access in a business, while Oracle Web Services Manager offers security and control for web services. In an advisory released yesterday, Oracle is “strongly” recommending that customers apply the patches as soon as possible.
Brazilian health surveillance platform breach exposes 100K+ sensitive documents
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
“This Security Alert addresses vulnerability CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” reads the security advisory.
“Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible. Oracle always recommends that customers remain on actively-supported versions and apply all Security Alerts and Critical Patch Update security patches without delay.”
The CVE-2026-21992 vulnerability has a very high severity score of 9.8 and affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, plus Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0.
Oracle says the issue is simple to exploit from a distance using HTTP and does not need login or user action, which raises the risk for servers that are open.
The fix came out through the Security Alert program. This program gives quick fixes for serious problems that are being exploited. But Oracle says these patches work only for versions that have Premier or Extended Support. Older versions that have no support might still be at risk.
Oracle shared in a blog post today that CVE-2026-21992 is serious. They advised customers to check the security alert for full details and information on patches.
