What is the CVSS score of CVE-2026-21992?

CVE-2026-21992 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle are affected by CVE-2026-21992?

A critical authentication bypass vulnerability in Oracle Identity Manager and Web Services Manager (versions 12.2.1.4.0 and 14.1.2.1.0) allows attackers to gain complete system access without…

Is there a public PoC exploit available for CVE-2026-21992?

Yes, a public proof-of-concept exploit is available for CVE-2026-21992. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-21992?

Within 24 hours: Identify all instances of Oracle Identity Manager and Web Services Manager in your environment; isolate affected systems from public network access and document current user activity logs. Within 7 days: Implement network segmentation to restrict access to affected systems, deploy WAF rules to block suspicious WebServices REST API requests, and disable Web Services Security components if operationally feasible. Within 30 days: Contact Oracle for patch status and expedited security updates; evaluate alternative identity management solutions; conduct forensic analysis for signs of exploitation; implement enhanced monitoring and alerting for authentication-related anomalies.

Oracle CVE-2026-21992

EUVD-2026-13486 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-03-20 secalert_us@oracle.com

Oracle Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 23, 2026 - 15:30 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13486

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 03:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

A critical authentication bypass vulnerability in Oracle Identity Manager and Oracle Web Services Manager allows remote attackers to completely compromise affected systems without any credentials. The vulnerability resides in the REST WebServices and Web Services Security components, affecting versions 12.2.1.4.0 and 14.1.2.1.0 of both products. With a CVSS score of 9.8 and no authentication required, this represents a severe risk to identity management infrastructure, though no current KEV listing or public POC has been documented in available sources.

Technical ContextAI

This vulnerability affects the REST WebServices component in Oracle Identity Manager and the Web Services Security component in Oracle Web Services Manager, both part of Oracle Fusion Middleware. Oracle Identity Manager is an enterprise identity management solution that handles provisioning, access management, and compliance, while Oracle Web Services Manager provides security and management capabilities for web services. The affected versions are 12.2.1.4.0 and 14.1.2.1.0 across both products. While no specific CWE is assigned, the authentication bypass nature suggests improper authentication or authorization flaws in the REST API or web services security layer that allow complete system takeover without credentials.

RemediationAI

Organizations must immediately apply security patches provided by Oracle for CVE-2026-21992 as detailed in the vendor advisory at https://www.oracle.com/security-alerts/alert-cve-2026-21992.html. Upgrade affected Oracle Identity Manager and Oracle Web Services Manager installations from versions 12.2.1.4.0 and 14.1.2.1.0 to the patched versions specified in the Oracle Critical Patch Update. Until patching can be completed, implement emergency mitigations including restricting network access to these services using firewall rules or network segmentation to allow only trusted IP ranges, deploying web application firewall rules to monitor and block suspicious REST API requests, and implementing additional authentication layers at the network perimeter. Disable external access to affected REST WebServices and Web Services Security endpoints if business operations permit. Monitor all access logs for unauthorized access attempts or anomalous authentication patterns that may indicate exploitation attempts.