Oracle CVE-2026-21992: CVSS 9.8 Critical Flaw in Identity Manager

Oracle has issued an emergency out-of-band security patch for CVE-2026-21992, a critical vulnerability in Oracle Identity Manager (OIM) carrying a CVSS score of 9.8. The flaw enables unauthenticated remote code execution against any publicly exposed OIM endpoint, making it one of the most severe enterprise identity management vulnerabilities disclosed in 2026.

Vulnerability Details

• CVE ID: CVE-2026-21992
• CVSS v3.1 Score: 9.8 (Critical)
• Affected Component: Oracle Identity Manager (OIM)
• Attack Vector: Network — no authentication required
• Impact: Full remote code execution on affected OIM server
• Patch Type: Emergency out-of-band (outside normal quarterly CPU)

Who Is Affected

Any enterprise running Oracle Identity Manager for user provisioning, access lifecycle management, or SSO federation that has OIM endpoints accessible from the network — even internal networks — is at risk. Organizations that have not applied this patch are exposed to complete compromise of their identity infrastructure.

Why This Is High Severity

Oracle Identity Manager is the control plane for user access across many large enterprises. A successful exploit doesn't just compromise one server — it provides an attacker with administrative access to provision accounts, escalate privileges, and move laterally across all systems integrated with OIM. In regulated industries, this triggers mandatory breach notification obligations.

The emergency out-of-band release is significant: Oracle almost never patches outside its quarterly CPU schedule. When it does, it signals active exploitation risk or an imminent public proof-of-concept, both of which sharply compress the safe patching window.

Recommended Actions

• Apply the emergency patch immediately — do not defer to the next CPU
• Review OIM access logs for anomalous provisioning activity since early April
• If immediate patching is not possible, restrict network access to OIM endpoints at the firewall level
• Enable enhanced audit logging on all OIM-provisioned accounts
• Notify your security operations center and begin threat hunting per your IR playbook