What is the CVSS score of CVE-2026-21999?

CVE-2026-21999 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Oracle XML Database CVE-2026-21999

EUVD-2026-24297 MEDIUM

Information Exposure (CWE-200)

2026-04-21 oracle

GHSA-8j6w-gmm7-v874

Authentication Bypass Information Disclosure Oracle Oracle Database Server Oracle Corporation

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable via HTTPS with no authentication required, but high complexity and mandatory user interaction confirmed; only confidentiality is impacted with no write or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:38 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24297

CVE Published

Apr 21, 2026 - 20:34 nvd

MEDIUM 5.3

DescriptionCVE.org

Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise XML Database. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all XML Database accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via network-accessible HTTPS endpoints in versions 23.4.0 through 23.26.1. An unauthenticated remote attacker exploiting this CWE-200 information exposure flaw - tagged as involving authentication bypass - can obtain complete access to all XML Database accessible data, but success requires high attack complexity and human interaction from a victim user. No active exploitation is confirmed (EPSS 0.03%, 9th percentile; CISA KEV absent; SSVC exploitation: none), placing this firmly in the patch-on-schedule category despite the high confidentiality impact stated in the CVSS.

Technical ContextAI

Oracle XML Database (XML DB) is a native, high-performance XML storage and retrieval engine built into Oracle Database Server, accessible through HTTP/HTTPS and SQL/XML interfaces including XDB repository, FTP, and WebDAV endpoints. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the XML DB component fails to properly restrict access to protected data under certain conditions - consistent with the 'Authentication Bypass' tag in the intelligence data, suggesting an access-control shortcut that can be triggered over HTTPS. Affected CPE is cpe:2.3:a:oracle_corporation:oracle_database_server:*:*:*:*:*:*:*:*, covering Oracle Database 23c versions from 23.4.0 up to and including 23.26.1.

RemediationAI

Apply Oracle's Critical Patch Update for April 2026, which addresses this vulnerability per the advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. An exact patched version number is not independently confirmed beyond the CPU bulletin - consult the Oracle My Oracle Support (MOS) portal or the advisory directly for the precise patch set or release update to apply. If immediate patching is not possible, compensating controls include restricting network access to Oracle XML DB HTTPS endpoints at the firewall or network ACL layer to trusted IP ranges only (note: this may disrupt legitimate XML DB HTTP/WebDAV clients), and reviewing Oracle XML DB HTTP server configuration to disable or restrict the XML DB repository protocol if it is not actively required - use the Oracle parameter xdb.cfg to disable HTTP listener functionality. These workarounds reduce the attack surface but do not eliminate the underlying vulnerability.