Back Csa.Sg

Critical Vulnerability in Oracle Products - Cyber Security Agency of Singapore (CSA)

Csa.Sg • March 23, 2026

Oracle has released security updates to address a critical vulnerability in Oracle Web Services Manager and Identity Manager. Users and administrators of affected products are advised to update to the latest versions immediately.

Oracle has released security updates to address a critical vulnerability (CVE-2026-21992) in Oracle Web Services Manager and Identity Manager. The vulnerability has a Common Vulnerability Scoring System (CVSSv3.1) score of 9.8 out of 10.

The critical vulnerability bypasses authentication through remote exploitation over HTTP with low complexity and no user interaction, making exposed enterprise identity management and web services infrastructure highly susceptible to immediate compromise. Successful exploitation could allow a remote unauthenticated attacker to perform arbitrary code execution on affected systems.

The vulnerability affects Oracle Web Services Manager and Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0.

Users and administrators of affected products are advised to update to the latest versions immediately.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in BeyondTrust Software Requires Immediate Patching BeyondTrust has issued a warning regarding a critical remote code execution (RCE) vulnerability in its Remote Support and Privileged Remote Access software. The flaw, tracked as CVE-2026-1731, allows unauthenticated attackers to execute arbitrary code remotely and affects versions 25.3.1 or earlier of Remote Support and 24.3.4 or earlier of Privileged Remote Access. Users are advised to apply the patches released on February 6, 2026, to mitigate the risk of exploitation. 1495 sources 67

Extracted Entities

CVEs (1)

CVE-2026-21992