CVE-2026-21977

lowpriority · track · 0EPSS 0.002 · 9 %ileEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.20% (9th) EPSS

CVSS 3.1 · low

Is it mine?

19 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · ncsc_nl

EPSS · scored 2026-10-27

Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: Security). Supported versions that are affected are 23.1.0-23.1.202509. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Zero Data Loss Recovery Appliance Software. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Zero Data Loss Recovery Appliance Software accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

cvss

Technical severity, 0–10. One row per scoring source.

3.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.13.1lowAV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.13.1lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.13.1lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · secalert_us@oracle.com USexploitability 1.6 · impact 1.4

v3.12.9lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.13.1lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20US

affected products (19)

Products and version ranges known to be affected.

Oracle Corporation Oracle Zero Data Loss Recovery Appliance Software≤ 23.1.0 ≤23.1.202509enisa_euvdEU
Oracle Corp. Zero Data Loss Recovery Appliance Software23.1.0 → 23.1.202509fstec_bduRU
Oracle Core RDBMS≤ vers:unknown/*ncsc_nlNL
Oracle Essbase≤ vers:unknown/*ncsc_nlNL
Oracle Fleet Patching and Provisioning≤ vers:unknown/*ncsc_nlNL
Oracle GoldenGate≤ vers:unknown/*ncsc_nlNL
Oracle GoldenGate Big Data and Application Adapters≤ vers:unknown/*ncsc_nlNL
Oracle GoldenGate Stream Analytics≤ vers:unknown/*ncsc_nlNL
Oracle GraalVM≤ vers:unknown/*ncsc_nlNL
Oracle Graph Server And Client≤ vers:unknown/*ncsc_nlNL
Oracle Java Virtual Machine≤ vers:unknown/*ncsc_nlNL
Oracle NoSQL Database≤ vers:unknown/*ncsc_nlNL
Oracle Oracle APEX Sample Applications≤ vers:unknown/*ncsc_nlNL
Oracle Oracle Database Server≤ vers:unknown/*ncsc_nlNL
Oracle Oracle Graal Development Kit for Micronaut≤ vers:unknown/*ncsc_nlNL
Oracle Oracle Zero Data Loss Recovery Appliance Software≤ vers:unknown/*ncsc_nlNL
Oracle SQLcl≤ vers:unknown/*ncsc_nlNL
Oracle Secure Backup≤ vers:unknown/*ncsc_nlNL
Oracle Spatial and Graph≤ vers:unknown/*ncsc_nlNL

advisories (1)

Vendor and ecosystem advisories describing this.

NCSC-2026-0021Kwetsbaarheden verholpen in Oracle Database Server productenNL2026-01-21csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Database Server producten.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu ncsc_nl NVD CVE.org MITRE

published 2026-01-20modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan