CVE-2026-21992

Overview

Oracle Corporation
Oracle Identity Manager

20 Mar 2026

Published

24 Mar 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.02%

MITRE

KEV

Description

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. Note: Oracle Web Services Manager is installed with an Oracle Fusion Middleware Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Statistics

7 Posts
3 Interactions

Last activity: 5 hours ago

Fediverse

TechNadu @technadu

Oracle alert 🚨
CVE-2026-21992 → unauth RCE (9.8)
Identity systems = high-value target
Emergency patch released

Source: https://www.securityweek.com/oracle-releases-emergency-patch-for-critical-identity-manager-vulnerability/

Assume breach? 👇
Follow @technadu

#Infosec #ZeroDay #Oracle

0
1
0
20h ago

CyberNetsecIO @netsecio

📰 URGENT: Oracle Patches Critical 9.8 CVSS Unauthenticated RCE Flaw

📢 URGENT PATCH: Oracle has issued an emergency fix for CVE-2026-21992, a critical 9.8 CVSS unauthenticated RCE flaw in Identity Manager. Unpatched systems can be fully compromised. Patch immediately! 🚨 #Oracle #CyberSecurity #RCE #PatchNow

🔗 https://cyber.netsecops.io/articles/oracle-issues-emergency-patch-for-critical-rce-flaw-cve-2026-21992/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

0
0
0
15h ago

Bluesky

Help Net Security @helpnetsecurity.com

Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992) 📖 Read more: www.helpnetsecurity.com/2026/03/23/o... #cybersecurity #cybersecuritynews #APIsecurity #identitymanagement

1
0
0
19h ago

キタきつね @kitafox.bsky.social

Oracle社、Identity Managerにおける認証前リモートコード実行の脆弱性（CVE-2026-21992）に対する緊急修正プログラムをリリース Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992) #HelpNetSecurity (Mar 23) www.helpnetsecurity.com/2026/03/23/o...

0
1
0
6h ago

CyberMaterial @cybermaterial.bsky.social

Oracle Patches Critical Identity RCE Read More: buff.ly/SRyprxy #OracleSecurity #CVE202621992 #RemoteCodeExecution #IdentitySecurity #PatchNow #VulnerabilityManagement #EnterpriseSecurity #InfosecAlert

0
0
0
15h ago

piggo @pigondrugs.bsky.social

~Sophos~ Critical unauthenticated RCE flaw in Oracle Fusion Middleware components. - IOCs: CVE-2026-21992 - #CVE2026_21992 #Oracle #threatintel

0
0
0
14h ago

セキュリティ対策Lab @securitylab-jp.bsky.social

Oracle Identity Managerに致命的な脆弱性(CVE-2026-21992) rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #セキュリティ #Security #CybersecurityNews

0
0
0
5h ago

CVE-2026-3055

Overview

NetScaler
ADC

23 Mar 2026

Published

24 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

Pending

MITRE

KEV

Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Statistics

8 Posts
9 Interactions

Last activity: 5 hours ago

Fediverse

Rishi @rxerium

🚨 CVE-2026-3055 (CVSS 9.3), a unauth memory overread vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances that could see active exploitation itw

Vulnerability detection script available here:
https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-3055.yaml

Patches are available as per Citrix's advisory:
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300

1
0
0
13h ago

:mastodon: decio @decio

➡️ CVE-2026-3055 👀
👇
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300

CVE-2026-3055 - Out-of-Bounds Read vulnerability - CVSSv4 base score: 9.3
Note: Citrix NetScaler ADC or Citrix Gateway must be configured as SAML IDP to be vulnerable to CVE-2026-3055.
- CVE-2026-4368 - Race Condition vulnerability - CVSSv4 base score: 7.7Note: Affected appliances must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP proxy) or AAA virtual server to be vulnerable CVE-2026-4368.

( -> https://cve.circl.lu/search?q=CVE-2026-3055 )

#cyberveille #CVE_2026_3055 #infosec

1
1
0
15h ago

circl @circl

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-3055 and CVE-2026-4368

#citrix #vulnerabilitymanagement #vulnerability

https://vulnerability.circl.lu/bundle/1ae9c3df-c65f-4755-b3a9-4d76f8c0e772

1
0
0
15h ago

Bluesky

Rapid7 @rapid7.com

🚨 On March 23, 2026, #Citrix published a security advisory for a critical vuln. affecting their NetScaler ADC & Gateway products. CVE-2026-3055, an out-of-bounds read, allows unauthenticated remote attackers to leak information from the appliance's memory. Read on: r-7.co/41nwCJ7

1
0
0
11h ago

tamosan @tamosan.bsky.social

CVE-2026-3055。アプライアンスがSAML IdP設定であればやられるようです。CVSSv4で9.3：Critical NetScaler ADC and Gateway Vulnerabilities Enable Remote Attacks on Affected Systems https://cybersecuritynews.com/netscaler-adc-and-gateway-vulnerabilities/

1
0
0
5h ago

Sami Laiho @samilaiho.com

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-3055 and CVE-2026-4368 #CRITICAL support.citrix.com/support-home...

1
0
0
15h ago

piggo @pigondrugs.bsky.social

~Certeu~ Citrix patched critical flaws in NetScaler ADC & Gateway allowing info disclosure and session mix-up. - IOCs: CVE-2026-3055, CVE-2026-4368 - #Citrix #ThreatIntel #Vulnerability

1
0
0
11h ago

piggo @pigondrugs.bsky.social

~Cybergcca~ CCCS issued 9 advisories, highlighting an actively exploited Craft CMS flaw (CVE-2025-32432) and critical Citrix NetScaler vulnerabilities. - IOCs: CVE-2025-32432, CVE-2026-3055, CVE-2026-4368 - #CISA_KEV #ThreatIntel #Vulnerability

1
0
0
14h ago

CVE-2025-32975

Overview

Pending

24 Jun 2025

Published

03 Nov 2025

Updated

CVSS

Pending

EPSS

0.13%

MITRE

KEV

Description

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.

Statistics

4 Posts
2 Interactions

Last activity: 12 hours ago

Fediverse

HackerWorkspace @hackerworkspace

Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems

https://thehackernews.com/2026/03/hackers-exploit-cve-2025-32975-cvss-100.html

Short summary: https://hackerworkspace.com/article/hackers-exploit-cve-2025-32975-cvss-10-0-to-hijack-unpatched-quest-kace-sma-systems

#cybersecurity #vulnerability #exploit

1
1
0
12h ago

CyberNetsecIO @netsecio

📰 Warning: Critical 10.0 CVSS Quest KACE Flaw from 2025 Now Actively Exploited

🔥 ACTIVE EXPLOITATION: A year-old, 10.0 CVSS flaw in Quest KACE SMA (CVE-2025-32975) is now being actively exploited. Attackers are gaining full admin control, deploying Mimikatz, and moving laterally. Patch and isolate from the internet NOW! #CVE

🔗 https://cyber.netsecops.io/articles/old-quest-kace-vulnerability-cve-2025-32975-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

0
0
0
15h ago

Bluesky

Cybersecurity News Everyday @hendryadrian.bsky.social

Hackers are exploiting CVE-2025-32975 (CVSS 10.0) to bypass authentication and take control of unpatched Quest KACE SMA systems. Activity includes credential theft, account creation, and RDP access. #QuestKACE #AuthenticationBypass #USA

0
0
0
23h ago

Ninja Owl @ninjaowl.ai

Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...

0
0
0
17h ago

CVE-2026-4368

Overview

NetScaler
ADC

23 Mar 2026

Published

24 Mar 2026

Updated

CVSS v4.0

HIGH (7.7)

EPSS

Pending

MITRE

KEV

Description

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Statistics

5 Posts
6 Interactions

Last activity: 11 hours ago

Fediverse

:mastodon: decio @decio

➡️ CVE-2026-3055 👀
👇
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300

CVE-2026-3055 - Out-of-Bounds Read vulnerability - CVSSv4 base score: 9.3
Note: Citrix NetScaler ADC or Citrix Gateway must be configured as SAML IDP to be vulnerable to CVE-2026-3055.
- CVE-2026-4368 - Race Condition vulnerability - CVSSv4 base score: 7.7Note: Affected appliances must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP proxy) or AAA virtual server to be vulnerable CVE-2026-4368.

( -> https://cve.circl.lu/search?q=CVE-2026-3055 )

#cyberveille #CVE_2026_3055 #infosec

1
1
0
15h ago

circl @circl

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-3055 and CVE-2026-4368

#citrix #vulnerabilitymanagement #vulnerability

https://vulnerability.circl.lu/bundle/1ae9c3df-c65f-4755-b3a9-4d76f8c0e772

1
0
0
15h ago

Bluesky

Sami Laiho @samilaiho.com

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-3055 and CVE-2026-4368 #CRITICAL support.citrix.com/support-home...

1
0
0
15h ago

piggo @pigondrugs.bsky.social

~Certeu~ Citrix patched critical flaws in NetScaler ADC & Gateway allowing info disclosure and session mix-up. - IOCs: CVE-2026-3055, CVE-2026-4368 - #Citrix #ThreatIntel #Vulnerability

1
0
0
11h ago

piggo @pigondrugs.bsky.social

~Cybergcca~ CCCS issued 9 advisories, highlighting an actively exploited Craft CMS flaw (CVE-2025-32432) and critical Citrix NetScaler vulnerabilities. - IOCs: CVE-2025-32432, CVE-2026-3055, CVE-2026-4368 - #CISA_KEV #ThreatIntel #Vulnerability

1
0
0
14h ago

CVE-2026-3587

Overview

WAGO
Lean Managed Switch 852-1812

23 Mar 2026

Published

23 Mar 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

0.09%

MITRE

KEV

Description

An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface and gain root access to the underlying Linux based OS, leading to full compromise of the device.

Statistics

2 Posts
3 Interactions

Last activity: 22 hours ago

Fediverse

CERT@VDE @certvde

#OT #Advisory VDE-2026-020
WAGO: Vulnerability in managed switches

A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
#CVE CVE-2026-3587

https://certvde.com/en/advisories/vde-2026-020/

#CSAF https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-020.json

1
1
0
23h ago

Offensive Sequence @offseq

WAGO 852-1812 switch hit with CRITICAL CVE-2026-3587 (CVSS 10.0): hidden CLI lets remote attackers gain root with no auth. No patch yet. Isolate, restrict access, & monitor closely. https://radar.offseq.com/threat/cve-2026-3587-cwe-912-hidden-functionality-in-wago-a4c55a72 #OffSeq #ICS #Infosec #Vulnerability

0
1
0
22h ago

CVE-2025-61144

Overview

Pending

23 Feb 2026

Published

25 Feb 2026

Updated

CVSS

Pending

EPSS

0.03%

MITRE

KEV

Description

libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.

Statistics

3 Posts

Last activity: 10 hours ago

Fediverse

Chuckles @celeduc

Oh good, a critical update for libtiff6. Ancient formats certainly carry a lot of baggage. https://nvd.nist.gov/vuln/detail/CVE-2025-61144

0
0
0
17h ago

Bluesky

ferramentaslinux.bsky.social @ferramentaslinux.bsky.social

Critical LibTIFF DoS vulnerabilities (CVE-2025-61143, CVE-2025-61144) patched for #Ubuntu 25.10, 24.04 LTS, 22.04 LTS, and earlier releases with Ubuntu Pro. Read more: 👉 tinyurl.com/yenkmaar #Security

0
0
0
15h ago

ferramentaslinux.bsky.social @ferramentaslinux.bsky.social

🚨 URGENT: #Ubuntu Security Update 🚨 Patch now for LibTIFF DoS flaws (CVE-2025-61143, CVE-2025-61144) affecting Ubuntu 25.10 down to 14.04 LTS. Read more: 👉 tinyurl.com/ue8e2zbv #Security

0
0
0
10h ago

CVE-2025-32432

Overview

craftcms
cms

25 Apr 2025

Published

21 Mar 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

89.44%

MITRE

KEV

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

Statistics

2 Posts
1 Interaction

Last activity: 14 hours ago

Bluesky

Undercode Testing @undercode.bsky.social

CISA Warns of Craft CMS Zero-Day Under Active Attack—Patch Now or Get Hacked + Video Introduction: A critical code injection vulnerability in Craft CMS, designated CVE-2025-32432, has been actively exploited as a zero-day since February 2025, prompting the U.S. Cybersecurity and Infrastructure…

0
0
0
16h ago

piggo @pigondrugs.bsky.social

~Cybergcca~ CCCS issued 9 advisories, highlighting an actively exploited Craft CMS flaw (CVE-2025-32432) and critical Citrix NetScaler vulnerabilities. - IOCs: CVE-2025-32432, CVE-2026-3055, CVE-2026-4368 - #CISA_KEV #ThreatIntel #Vulnerability

1
0
0
14h ago

CVE-2026-3909

Overview

Google
Chrome

12 Mar 2026

Published

14 Mar 2026

Updated

CVSS

Pending

EPSS

4.44%

MITRE

KEV

Description

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Statistics

1 Post
2 Interactions

Last activity: 6 hours ago

Fediverse

𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 :verified: @youranonnewsirc

Global cybersecurity alerts include active exploitation of Chrome Zero-Days (CVE-2026-3909/3910) and a Quest KACE SMA flaw for credential harvesting. Advanced threats like Android haptic keyloggers and deepfake identity fraud are emerging. Geopolitically, Persian Gulf tensions remain high, while the US announced a new cyber strategy to defend companies from foreign adversaries. In tech, NVIDIA Nemotron 3 Super is now on Amazon Bedrock.

#Cybersecurity #GeopoliticalNews #TechBrief

2
0
0
6h ago

CVE-2026-1207

Overview

djangoproject
Django
django

03 Feb 2026

Published

03 Feb 2026

Updated

CVSS

Pending

EPSS

5.46%

MITRE

KEV

Description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

Statistics

2 Posts
2 Interactions

Last activity: 15 hours ago

Fediverse

CrowdSec @CrowdSec

🚨 In this week’s threat alert, CrowdSec reports on CVE-2026-1207, a critical Django SQL injection vulnerability now actively exploited in the wild. Attackers are targeting GeoDjango setups using PostGIS with focused reconnaissance. Notably, this vulnerability hasn’t yet been added to the CISA KEV catalog.

Learn how the vulnerability works and how to secure your systems in our latest article: https://www.crowdsec.net/vulntracking-report/cve-2026-1207

1
1
1
15h ago

CVE-2026-20131

Overview

Cisco
Cisco Secure Firewall Management Center (FMC)

04 Mar 2026

Published

20 Mar 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

0.65%

MITRE

KEV

Description

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Statistics

1 Post
1 Interaction

Last activity: 2 hours ago

Bluesky

piggo @pigondrugs.bsky.social

~Zscaler~ Unauthenticated RCE vulnerability (CVSS 10) in Cisco Secure FMC actively exploited in the wild, granting root access. - IOCs: CVE-2026-20131 - #CVE202620131 #Cisco #RCE #ThreatIntel

1
0
0
2h ago