# Oracle Identity Manager RCE flaw CVE-2026-21992

Published: 2026-03-23 · Severity: high · Sectors: government-national, financial-services, technology
Canonical: https://vorant.io/reports/da19494e-a7e0-571c-8418-f482347001cc/oracle-identity-manager-rce-flaw-cve-2026-21992

> A critical unauthenticated RCE vulnerability in Oracle Identity Manager and Web Services Manager allows attackers to execute arbitrary code remotely without authentication.

Oracle has disclosed CVE-2026-21992, a remotely exploitable vulnerability affecting Oracle Identity Manager and Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0. The flaw requires no authentication and allows attackers to achieve remote code execution on vulnerable systems. Successful exploitation could enable attackers to install programs, modify or delete data, or create new accounts with full privileges depending on the context of the compromised service.

The vulnerability is categorized under MITRE ATT&CK technique T1190 (Exploit Public-Facing Application) as an initial access vector. Oracle Identity Manager handles user provisioning and identity administration, while Oracle Web Services Manager provides security and policy management for web services within Oracle Fusion Middleware. Both products are commonly deployed in enterprise environments for critical identity and access management functions.

As of this advisory's publication, there are no reports of active exploitation in the wild. Organizations running affected versions should prioritize patching, implement network segmentation to isolate vulnerable systems, and apply the principle of least privilege to minimize potential impact. The MS-ISAC has rated this vulnerability as high risk for government and business environments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-21992

## Detection guidance (public sample)

### Suspicious Child Process Spawned from Java (Oracle Identity Manager/WebLogic) Process

ATT&CK: T1190

Detects cmd.exe or powershell.exe spawned by java.exe, consistent with post-exploitation command execution following an unauthenticated RCE against Oracle Identity Manager/Oracle Web Services Manager (CVE-2026-21992). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Shell Spawned from Java Process (Oracle Middleware RCE)
id: 3ddb9eae-d711-5135-a486-b077a45dbd56
status: experimental
description: Detects command interpreters (cmd.exe, powershell.exe) spawned as a child
  of java.exe, a behavior consistent with successful exploitation of an unauthenticated
  RCE in Oracle Identity Manager or Oracle Web Services Manager (CVE-2026-21992).
  Java-based application servers should rarely spawn OS shells directly.
references:
- CVE-2026-21992
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \java.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \powershell_ise.exe
    - \cscript.exe
    - \wscript.exe
  filter_known_admin:
    CommandLine|contains:
    - Configuration Wizard
    - opatch
  condition: selection and not filter_known_admin
falsepositives:
- Legitimate administrative scripts invoked by Java-based deployment or patching tools
  (e.g., Oracle opatch, WebLogic Configuration Wizard)
- Custom monitoring agents written in Java that legitimately shell out to run diagnostic
  commands
level: high
```

### Shell Spawned from Java Process on Linux (Oracle Middleware RCE)

ATT&CK: T1190

Detects sh/bash spawned as a child of a java process, consistent with OS command execution following exploitation of Oracle Identity Manager/Oracle Web Services Manager unauthenticated RCE on Linux-hosted Fusion Middleware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Shell Spawned from Java Process on Linux (Oracle Middleware RCE)
id: d18bb642-c132-5fd8-8d6a-d92ea1e0a094
status: experimental
description: Detects a shell interpreter (sh, bash) launched as a direct child of
  a java process on Linux, which may indicate command execution following exploitation
  of an unauthenticated RCE such as CVE-2026-21992 affecting Oracle Identity Manager
  or Oracle Web Services Manager deployed on Linux application servers.
references:
- CVE-2026-21992
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /java
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
  filter_maintenance:
    CommandLine|contains:
    - opatch
    - configWizard
  condition: selection and not filter_maintenance
falsepositives:
- Legitimate Oracle Fusion Middleware maintenance scripts (opatch, config wizard)
  that shell out from Java-based tooling
- Custom health-check or monitoring scripts that invoke shell commands from a Java
  process
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-oracle-products-could-allow-for-remote-code-execution_2026-024

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/da19494e-a7e0-571c-8418-f482347001cc/oracle-identity-manager-rce-flaw-cve-2026-21992.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup