Oracle Identity Manager RCE flaw CVE-2026-21992
A critical unauthenticated RCE vulnerability in Oracle Identity Manager and Web Services Manager allows attackers to execute arbitrary code remotely without authentication.
Oracle has disclosed CVE-2026-21992, a remotely exploitable vulnerability affecting Oracle Identity Manager and Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0. The flaw requires no authentication and allows attackers to achieve remote code execution on vulnerable systems. Successful exploitation could enable attackers to install programs, modify or delete data, or create new accounts with full privileges depending on the context of the compromised service.
The vulnerability is categorized under MITRE ATT&CK technique T1190 (Exploit Public-Facing Application) as an initial access vector. Oracle Identity Manager handles user provisioning and identity administration, while Oracle Web Services Manager provides security and policy management for web services within Oracle Fusion Middleware. Both products are commonly deployed in enterprise environments for critical identity and access management functions.
As of this advisory's publication, there are no reports of active exploitation in the wild. Organizations running affected versions should prioritize patching, implement network segmentation to isolate vulnerable systems, and apply the principle of least privilege to minimize potential impact. The MS-ISAC has rated this vulnerability as high risk for government and business environments.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from Java (Oracle Identity Manager/WebLogic) Process
Detects cmd.exe or powershell.exe spawned by java.exe, consistent with post-exploitation command execution following an unauthenticated RCE against Oracle Identity Manager/Oracle Web Services Manager (CVE-2026-21992). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Spawned from Java Process (Oracle Middleware RCE)
id: 3ddb9eae-d711-5135-a486-b077a45dbd56
status: experimental
description: Detects command interpreters (cmd.exe, powershell.exe) spawned as a child
of java.exe, a behavior consistent with successful exploitation of an unauthenticated
RCE in Oracle Identity Manager or Oracle Web Services Manager (CVE-2026-21992).
Java-based application servers should rarely spawn OS shells directly.
references:
- CVE-2026-21992
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \java.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \powershell_ise.exe
- \cscript.exe
- \wscript.exe
filter_known_admin:
CommandLine|contains:
- Configuration Wizard
- opatch
condition: selection and not filter_known_admin
falsepositives:
- Legitimate administrative scripts invoked by Java-based deployment or patching tools
(e.g., Oracle opatch, WebLogic Configuration Wizard)
- Custom monitoring agents written in Java that legitimately shell out to run diagnostic
commands
level: high
Shell Spawned from Java Process on Linux (Oracle Middleware RCE)
Detects sh/bash spawned as a child of a java process, consistent with OS command execution following exploitation of Oracle Identity Manager/Oracle Web Services Manager unauthenticated RCE on Linux-hosted Fusion Middleware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Spawned from Java Process on Linux (Oracle Middleware RCE)
id: d18bb642-c132-5fd8-8d6a-d92ea1e0a094
status: experimental
description: Detects a shell interpreter (sh, bash) launched as a direct child of
a java process on Linux, which may indicate command execution following exploitation
of an unauthenticated RCE such as CVE-2026-21992 affecting Oracle Identity Manager
or Oracle Web Services Manager deployed on Linux application servers.
references:
- CVE-2026-21992
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /java
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
filter_maintenance:
CommandLine|contains:
- opatch
- configWizard
condition: selection and not filter_maintenance
falsepositives:
- Legitimate Oracle Fusion Middleware maintenance scripts (opatch, config wizard)
that shell out from Java-based tooling
- Custom health-check or monitoring scripts that invoke shell commands from a Java
process
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-oracle-products-could-allow-for-remote-code-execution_2026-024
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free