CVE-2026-21992

The vulnerability classified as CWE-306 (Missing Authentication for Critical Function) affects the REST WebServices components in Oracle Identity Manager and Web Services Security in Oracle Web Services Manager. An attacker with network access to the vulnerable system can send HTTP requests to critical functions without the need for authentication. The protective mechanism in the form of identity verification is absent or can be bypassed, enabling unauthorized system-level operations.

Successful exploitation of this vulnerability leads to complete takeover of Oracle Identity Manager and Oracle Web Services Manager, resulting in loss of confidentiality, integrity, and availability of data and services managed by these systems.

Apply patches available from the vendor according to references published at https://www.oracle.com/security-alerts/alert-cve-2026-21992.html. Until patches are deployed, it is recommended to restrict network access to REST WebServices and Web Services Security components exclusively to trusted hosts and internal networks using firewall or ACL lists.

Oracle Identity Manager (component: REST WebServices) and Oracle Web Services Manager (component: Web Services Security) in versions 12.2.1.4.0 and 14.1.2.1.0, which are part of Oracle Fusion Middleware. Oracle Web Services Manager is installed together with Oracle Fusion Middleware Infrastructure.