CVE-2026-21979

Unknown Unknown - Not Provided

Privilege Escalation in Oracle EPM Agent Allows Data Access

Publication date: 2026-01-20

Last updated on: 2026-01-20

Assigner: Oracle

Description

Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent). The supported version that is affected is 25.04.07. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Planning and Budgeting Cloud Service executes to compromise Oracle Planning and Budgeting Cloud Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Planning and Budgeting Cloud Service accessible data. Note: Update EPM Agent. Please refer to <a href="https://docs.oracle.com/en/cloud/saas/enterprise-performance-management-common/diepm/epm_agent_downloading_agent_110x80569d70.html">Downloading the EPM Agent for more information. CVSS 3.1 Base Score 4.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-20

Last Modified

2026-01-20

Generated

2026-07-06

AI Q&A

2026-01-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-21979

EUVD

EUVD-2026-3533

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	planning_and_budgeting_cloud_service	25.04.07

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Oracle Planning and Budgeting Cloud Service, specifically in the EPM Agent component. It affects version 25.04.07 and allows a high privileged attacker who has logged on to the infrastructure where the service runs to compromise the Oracle Planning and Budgeting Cloud Service. Exploiting this vulnerability requires human interaction from someone other than the attacker. Successful exploitation can lead to unauthorized access to critical or all accessible data within the service.

Impact Analysis

The impact of this vulnerability includes unauthorized access to critical data or complete access to all data accessible by the Oracle Planning and Budgeting Cloud Service. This means sensitive or important information could be exposed or compromised by an attacker with high privileges on the infrastructure.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the EPM Agent to the latest version as recommended by Oracle. Please refer to the official Oracle documentation on downloading and updating the EPM Agent for more information.

Hi! I’m here to help you understand CVE-2026-21979. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70