CVE-2026-21992
CVSS 9.8 CRITICAL: vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and… EPSS 1% (58º percentile), in aumento rispetto a 0.07%.
Vulnerabilità ed exploit · Attacco ad app web
La vulnerabilità ha CVSS 9.8 e permette a un attaccante non autenticato via HTTP(S) di eseguire codice remoto senza interazione utente. Le versioni 12.2.1.4.0 e 14.1.2.1.0 sono confermate vulnerabili; release non supportate potrebbero esserlo.
6 fonti · 23 mar
CVSS 9.8 CRITICAL: vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and… EPSS 1% (58º percentile), in aumento rispetto a 0.07%.
Help Net Security
Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992) - Help Net Security
Oracle has fixed an easily exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager.
originaleSecurityWeek
Oracle Releases Emergency Patch for Critical Identity Manager Vulnerability
CVE-2026-21992 can be used without authentication for remote code execution and it may have been exploited in the wild.
originaleThe Hacker News
Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager
Oracle fixes CVE-2026-21992 (CVSS 9.8) flaw enabling unauthenticated RCE via HTTP, risking full system compromise.
originalePart of the PlainSec briefing for 2026-03-24
Every edition of this story: Oracle rilascia patch d'emergenza per RCE pre-auth in Identity Manager