Cyber Resilience

CVE-2026-21940

High

Published: 20 January 2026

Published
20 January 2026
Modified
29 January 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0007 20.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21940 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Oracle Supply Chain Products Suite. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-7 (Boundary Protection).

Deeper analysis

CVE-2026-21940 is a vulnerability in the User and User Group component of Oracle Agile PLM, a product within Oracle Supply Chain. The supported version affected is 9.3.6. This easily exploitable issue, associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), carries a CVSS 3.1 Base Score of 7.5 with the vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), primarily impacting confidentiality.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Agile PLM. Successful exploitation grants unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.

Oracle has published a security alert at https://www.oracle.com/security-alerts/cpujan2026.html, which provides details on the vulnerability and associated mitigations or patches.

EU & UK References

Vulnerability details

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.…

more

Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE(s)
CWE-200

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct unauthenticated network exposure of sensitive data in a public-facing Oracle web application maps to exploitation of public-facing apps for initial access and data compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-34297Same vendor: Oracle
CVE-2026-34305Same vendor: Oracle
CVE-2026-22016Same vendor: Oracle
CVE-2026-46839Same vendor: Oracle
CVE-2025-21515Same vendor: Oracle
CVE-2025-30743Same vendor: Oracle
CVE-2026-46775Same vendor: Oracle
CVE-2026-34291Same vendor: Oracle
CVE-2025-21524Same vendor: Oracle
CVE-2026-46817Same vendor: Oracle

Affected Assets

oracle
supply chain products suite
9.3.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Flaw remediation requires timely patching of the specific vulnerability in Oracle Agile PLM's User and User Group component to prevent unauthorized data access.

SC-7 Boundary Protection good match
prevent

Boundary protection monitors and controls network communications at external interfaces, blocking unauthenticated HTTP access to the vulnerable component.

AC-3 Access Enforcement good match
prevent

Access enforcement mechanisms ensure approved authorizations are applied to prevent unauthorized logical access to critical data in Oracle Agile PLM.

References