CVE-2026-21999
XML Database Unauthorized Access Vulnerability in Oracle Database
Publication date: 2026-04-21
Last updated on: 2026-04-22
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | database_server | From 23.4.0 (inc) to 23.26.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the XML Database component of Oracle Database Server versions 23.4.0 through 23.26.1. It is difficult to exploit and allows an unauthenticated attacker with network access via HTTPS to compromise the XML Database. However, successful exploitation requires human interaction from someone other than the attacker.
If exploited, the attacker can gain unauthorized access to critical data or even complete access to all data accessible through the XML Database.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized access to critical data or complete access to all XML Database accessible data, which could lead to a breach of sensitive information.
Such unauthorized access and potential data compromise may impact compliance with data protection regulations and standards like GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access.
However, the provided information does not specify direct effects or compliance implications related to these standards.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to sensitive or critical data stored in the XML Database component of Oracle Database Server. An attacker exploiting this flaw could compromise confidentiality by accessing data they should not have permission to see.
Because the vulnerability does not impact integrity or availability, the main impact is on confidentiality, potentially exposing sensitive information.