Oracle XML Database CVE-2026-21999

Exploitation requires network access to the Oracle XML Database component via HTTPS, making any internet-exposed Oracle DB deployment with XML DB HTTP services enabled higher risk than internally-isolated instances. High attack complexity (AC:H) is confirmed by both the CVSS vector and the SSVC 'Automatable: no' determination - automated scanning or spray-and-pray attacks are not viable. Human interaction (UI:R) is an absolute prerequisite: an authenticated or session-bearing user must perform some action (e.g., visit a URL, trigger a redirect) as part of the attack. The 'Authentication Bypass' tag implies that Oracle's normal database authentication may be circumvented by the vulnerability mechanism itself, though the exact bypass condition is not disclosed in the available advisory text. Limiting factors: requires Oracle Database 23.4.0-23.26.1 specifically; XML DB HTTP/HTTPS listener must be enabled and network-accessible; victim user interaction is mandatory; high attack complexity precludes reliable weaponization without precise precondition control.

Multiple risk signals converge to indicate low immediate operational priority despite a high confidentiality impact rating. The CVSS 3.1 score of 5.3 is already moderated by AC:H (high attack complexity) and UI:R (required human interaction), both of which are genuine friction points for real-world exploitation. EPSS at 0.03% (9th percentile) reflects extremely low observed exploitation probability across the broader vulnerability ecosystem - well below thresholds typically used for emergency patching. SSVC confirms Exploitation: none and Automatable: no, consistent with the AC:H/UI:R constraints. The vulnerability is not in CISA KEV and no POC is referenced in available intelligence. The 'Authentication Bypass' tag adds some concern - it suggests the attack may sidestep normal Oracle DB authentication - but the attacker still cannot exploit this autonomously without victim interaction. Net assessment: real risk of targeted data exfiltration exists if an attacker can engineer a specific user interaction scenario, but mass exploitation or automated scanning is not plausible. Apply Oracle's April 2026 CPU patch during the next scheduled maintenance window rather than on an emergency basis.

An attacker with network access to the Oracle Database Server's HTTPS-exposed XML DB endpoint identifies a scenario requiring victim interaction - for example, luring a logged-in database user or administrator into clicking a crafted link or opening a malicious document that triggers a cross-origin or redirect-based request to the XML DB HTTPS interface. The high attack complexity (AC:H) suggests additional preconditions such as specific timing, race conditions, or configuration state. Upon successful exploitation, the attacker gains read access to all data stored within the XML Database component accessible to the victim's session context.