CVE-2026-21999

CVE-2026-21999 is a vulnerability in Oracle Database Server's XML Database component affecting versions 23.4.0 through 23.26.1. An unauthenticated attacker with network access can exploit this flaw via HTTPS to gain unauthorized access to critical data or complete access to XML Database contents. The vulnerability requires human interaction from a third party, making it dependent on social engineering or user manipulation for successful exploitation. The attack is rated MEDIUM severity with a CVSS 3.1 base score of 5.3, characterized by network accessibility, high attack complexity, and no required authentication. The primary impact is confidentiality compromise with no integrity or availability effects. The attack vector and user interaction requirement significantly increase the difficulty of exploitation compared to similar vulnerabilities. There is no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, has an extremely low EPSS score of 0.0003, and is rated as inactive on vulnerability tracking lists. No public exploit code is known to be available, and community attention remains minimal, indicating low real-world risk at this time.