X-twitter Facebook-f Pinterest-p
X-twitter Facebook-f Pinterest-p

Oracle fixes critical RCE flaw CVE-2026-21992 in Identity Manager


Oracle fixes critical RCE flaw CVE-2026-21992 in Identity Manager

Pierluigi Paganini
March 22, 2026

Oracle fixed a critical severity flaw, tracked as CVE-2026-21992, enabling unauthenticated remote code execution in Identity Manager.

Oracle released security updates to address a critical vulnerability, tracked as CVE-2026-21992 (CVSS score of 9.8), affecting Identity Manager and Web Services Manager.

The flaw lets unauthenticated attackers over HTTP take control of Oracle Identity Manager and Web Services Manager, risking full system compromise with severe impact on data and availability.

“This Security Alert addresses vulnerability CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution.” reads the advisory.

“Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible. Oracle always recommends that customers remain on actively-supported versions and apply all Security Alerts and Critical Patch Update security patches without delay.”

The issue is labeled as “easily exploitable.”

The vulnerability impacts Oracle Web Services Manager and Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0.

Oracle did not reveal if the vulnerability was exploited in attacks in the wild.

In November 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle Fusion Middleware flaw, tracked as CVE-2025-61757  (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.

The vulnerability is a missing authentication for a critical function that can result in pre-authenticated remote code execution. The flaw is easily exploitable and allows an unauthenticated attacker with HTTP network access to compromise Identity Manager, enabling a full takeover of the system.

The flaw impacts versions 12.2.1.4.0 and 14.1.2.1.0. Oracle addressed the flaw with the release of Oracle Critical Patch Update Advisory – October 2025.

Adam Kues and Shubham Shah of Assetnote reported the vulnerability.

SANS researcher Johannes B. Ullrich recently reported that an analysis of his organization’s honeypot logs revealed multiple HTTP POST attempts between August 30 and September 9, 2025, targeting the Oracle Identity Manager endpoint associated with CVE-2025-61757. The scans originated from different IPs but used the same user agent, suggesting a single attacker. The 556-byte POST payloads indicate likely exploitation as a zero-day, weeks before Oracle released a patch. Attempts came from 89.238.132[.]76, 185.245.82[.]81, and 138.199.29[.]153.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Oracle Identity Manager)





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

5 reasons to reconsider using it

Russia-linked actors target WhatsApp and Signal in phishing campaign

Oracle fixes critical RCE flaw CVE-2026-21992 in Identity Manager

U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog

Fact-checking Google’s AI Overviews just got a little easier – here’s how

Russia-linked actors target WhatsApp and Signal in phishing campaign

Oracle fixes critical RCE flaw CVE-2026-21992 in Identity Manager

U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog

6 new shows to watch on Netflix in March

Russia-linked actors target WhatsApp and Signal in phishing campaign

Oracle fixes critical RCE flaw CVE-2026-21992 in Identity Manager

U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog

Recent Reviews

Fact-checking Google’s AI Overviews just got a little easier – here’s how


Google's AI Overviews show the original sources in pop-up windows

Screenshot by Lance Whitney/ZDNET

Follow ZDNET: Add us as a preferred source on Google.

ZDNET’s key takeaways

  • Google’s AI now shows you the original sources via pop-up windows.
  • The new option works in both AI Overviews and AI Mode.
  • Just click the link in the pop-up to view the source’s website.

I often turn to Google’s AI Overviews and AI Mode when I run a search on a particular topic. The resulting Gemini-based summaries can cut to the chase by providing the gist of the information I seek. But there’s one big downside. AI can be wrong. For that reason, I never rely solely on AI; I always double-check the original sources used to create the summary. And now Google has made that process easier.

Also: How to get rid of AI Overviews in Google Search: 4 easy ways

\In a recent post on X, Robby Stein, product VP for Google Search, announced a new feature designed to benefit all Google users. With both AI Overviews and AI Mode, groups of links now automatically appear in a pop-up window as you hover over them. This means you can jump to the website for any specific source more quickly to double-check the information in the AI summary.

Here’s how this plays out.

Just click the links to verify AI’s information

Head to Google’s search engine via your favorite desktop browser. Enter a search word or phrase in the search field. In response, Google will likely show you an AI Overview at or near the top of the regular results.

Within the overview, you should see links at the end of each paragraph or section. Hover over one of those links, and a small window pops up with a description and link for the source used to compile the overview. Click the link, and you’re taken to the source’s website where you can verify the information and get the full story.

Also: I tested Google Docs’ new AI audio summaries, and they’re a massive time-saver

This also works in AI Mode. Select the heading at the top for AI Mode. Hover over a link contained in the AI summary to see the sources consulted for that particular paragraph or section. From the pop-up window, click the link for a source to visit its website.

“Our testing shows this new UI is more engaging, making it easier to get to great content across the web,” Stein said in his post.

Google had already been displaying a list of sources used by Gemini on the right side of the screen. But now the new pop-up windows make it easier to see which source contributed to which content. Rather than rely on AI Overview or AI Mode summaries alone, you’ll want to check out the original sources, and this new option makes it easier than ever.





Source link

PayPal discloses extended data leak linked to Loan App glitch

U.S. CISA adds RoundCube Webmail flaws to its Known Exploited Vulnerabilities catalog

Security Affairs newsletter Round 564 by Pierluigi Paganini – INTERNATIONAL EDITION

Copyright © 2024 All Rights Reserved.