What is the CVSS score of CVE-2026-21992?

CVE-2026-21992 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-21992?

Yes, a public proof-of-concept exploit is available for CVE-2026-21992. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-21992?

Within 24 hours: Identify all instances of Oracle Identity Manager and Web Services Manager in your environment; isolate affected systems from public network access and document current user activity logs. Within 7 days: Implement network segmentation to restrict access to affected systems, deploy WAF rules to block suspicious WebServices REST API requests, and disable Web Services Security components if operationally feasible. Within 30 days: Contact Oracle for patch status and expedited security updates; evaluate alternative identity management solutions; conduct forensic analysis for signs of exploitation; implement enhanced monitoring and alerting for authentication-related anomalies.

Oracle CVE-2026-21992

EUVD-2026-13486 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-03-20 secalert_us@oracle.com

Authentication Bypass Oracle

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send unauthenticated HTTP request to REST WebServices
Exploit

Bypass authentication validation in Web Services Security
Execution

Execute arbitrary operations
Impact

Achieve full system compromise

Vulnerability Assessment

Weakness	CWE CWE-306 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication required for critical functions MITRE ATT&CK 1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Unauthenticated remote attacker with network access via HTTP to Oracle Identity Manager (versions 12.2.1.4.0, 14.1.2.1.0) REST WebServices component or Oracle Web Services Manager (same versions) Web Services Security component. No victim interaction required. Default configurations are vulnerable.
Impact	This vulnerability represents an exceptionally high risk based on multiple threat indicators. The CVSS 3.1 score of 9.8 reflects maximum severity across all dimensions: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and complete impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The combination of unauthenticated remote exploitation with complete system takeover makes this immediately exploitable and highly automatable. Oracle Identity Manager and Web Services Manager are critical infrastructure components protecting enterprise identities and services, making compromise catastrophic for organizations. While no EPSS score or KEV status is provided in the intelligence sources, the ease of exploitation and high impact suggest attackers would prioritize this vulnerability once details emerge. The lack of public POC currently limits immediate risk, but organizations should treat this as an emergency patch priority given the complete control an attacker gains over identity management systems.
Exploit ScenarioDerived	An unauthenticated attacker scans the internet for exposed Oracle Identity Manager or Web Services Manager installations on standard HTTP ports. Upon identifying a vulnerable instance, the attacker sends specially crafted HTTP requests to the REST WebServices or Web Services Security endpoints, exploiting the authentication bypass to gain administrative access. With complete system takeover achieved, the attacker can create privileged accounts, steal sensitive identity data including credentials and personal information, modify access policies to establish persistence, or pivot to connected enterprise systems using the compromised identity management platform as a trusted intermediary.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 20, 2026

A critical authentication bypass vulnerability in Oracle Identity Manager and Oracle Web Services Manager allows remote attackers to completely compromise affected systems without any credentials. The vulnerability resides in the REST WebServices and Web Services Security components, affecting versions 12.2.1.4.0 and 14.1.2.1.0 of both products. With a CVSS score of 9.8 and no authentication required, this represents a severe risk to identity management infrastructure, though no current KEV listing or public POC has been documented in available sources.

RemediationAI

Organizations must immediately apply security patches provided by Oracle for CVE-2026-21992 as detailed in the vendor advisory at https://www.oracle.com/security-alerts/alert-cve-2026-21992.html. Upgrade affected Oracle Identity Manager and Oracle Web Services Manager installations from versions 12.2.1.4.0 and 14.1.2.1.0 to the patched versions specified in the Oracle Critical Patch Update. Until patching can be completed, implement emergency mitigations including restricting network access to these services using firewall rules or network segmentation to allow only trusted IP ranges, deploying web application firewall rules to monitor and block suspicious REST API requests, and implementing additional authentication layers at the network perimeter. Disable external access to affected REST WebServices and Web Services Security endpoints if business operations permit. Monitor all access logs for unauthorized access attempts or anomalous authentication patterns that may indicate exploitation attempts.

Affected VersionsENISA

Oracle Identity Manager 12.2.1.4.0

Oracle Web Services Manager 14.1.2.1.0

Oracle Identity Manager 14.1.2.1.0

Oracle Web Services Manager 12.2.1.4.0

Affected Packages

euvd oracle_identity_manager no fix

euvd oracle_web_services_manager no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability affects the REST WebServices component in Oracle Identity Manager and the Web Services Security component in Oracle Web Services Manager, both part of Oracle Fusion Middleware. Oracle Identity Manager is an enterprise identity management solution that handles provisioning, access management, and compliance, while Oracle Web Services Manager provides security and management capabilities for web services. The affected versions are 12.2.1.4.0 and 14.1.2.1.0 across both products. While no specific CWE is assigned, the authentication bypass nature suggests improper authentication or authorization flaws in the REST API or web services security layer that allow complete system takeover without credentials.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 23, 2026 - 15:30 vuln.today

Public exploit code

CVE Published

Mar 20, 2026 - 03:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

A critical authentication bypass vulnerability in Oracle Identity Manager and Web Services Manager (versions 12.2.1.4.0 and 14.1.2.1.0) allows attackers to gain complete system access without credentials, directly threatening the security of identity infrastructure and all downstream applications that depend on these systems for authentication. Organizations using affected versions face immediate risk of unauthorized access, data breach, and potential lateral movement across enterprise systems.

Business Impact: Severe

Compensating Controls

Implement network-level segmentation to restrict access to affected Oracle Identity Manager and Web Services Manager instances; deploy Web Application Firewall (WAF) rules to block anomalous REST API requests to WebServices endpoints; disable Web Services Security components if business operations permit; enforce VPN/bastion host access requirements for system administration; implement real-time monitoring and alerting for authentication bypass indicators and unusual API activity; increase logging and audit trail retention for identity manager transactions; consider temporarily disabling public-facing REST WebServices until patch availability.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment NEWS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.