Oracle fixes CVE-2026-21992 (CVSS 9.8) flaw enabling unauthenticated RCE via HTTP, risking full system compromise.
Hackers aren't "breaking" your MFA anymore — they’re just riding shotgun during your login to steal the session token right out from under you.