Oracle Identity Manager and Oracle Web Services Manager CVE 9.8 - CVE-2026-21992

This Security Alert addresses vulnerability CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution.

And it's in the IDM REST WebServices. I'd assume it's publically exposed? Doesn't sound like a management interface, but I could be wrong.

Extremely nasty stuff. I think Oracle uses these to run it's cloud..