Empirica Signal CVE-2026-21997

Requires a valid low-privilege authenticated account on Oracle Life Sciences Empirica Signal (CVSS PR:L) with network reachability to the application's HTTP interface (AV:N); no user interaction and low attack complexity are needed (UI:N/AC:L). Affected deployments are limited to supported versions 9.2.1 through 9.2.3 running the Common Core component. The primary limiting factor is the authentication requirement - an attacker must already possess or obtain low-privilege credentials - so unauthenticated internet-facing exploitation is not supported by the CVSS vector despite the 'Authentication Bypass' tag; the scope change (S:C) means successful exploitation can reach data or products under a separate security authority.

Signals here are mixed and lean toward moderate real-world urgency rather than emergency. CVSS 3.1 is 8.5 (High), driven by network vector (AV:N), low complexity (AC:L), no user interaction (UI:N), scope change (S:C), and high integrity impact (I:H) - but it explicitly requires privileges (PR:L), so this is not an unauthenticated flaw. Counterbalancing the high CVSS, EPSS is only 0.03% (8th percentile) and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial - all indicating low likelihood of imminent, widespread exploitation. There is no KEV listing and no public exploit identified at time of analysis. Note a tension worth verifying: the 'Authentication Bypass' tag implies pre-auth access, yet the CVSS vector requires PR:L (an authenticated low-privilege account) - the description's 'low privileged attacker' should be treated as authoritative, so an attacker needs at least a valid low-privilege account. Net: a genuine High-severity integrity/access-control issue, but current exploitation pressure is low.

A user holding a low-privilege Empirica Signal account authenticates over HTTP and sends crafted requests that bypass access-control checks in the Common Core component, allowing them to modify or delete critical safety/signal data and read data they should not see. Because of the scope change, the impact can extend to integrated products beyond Empirica Signal itself. No public exploit code is known, so an attacker would need to develop the technique independently.