CVE-2021-2114: Oracle Common Applications Calendar unauthenticated data access flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.2 with unauthenticated network reachability and high confidentiality impact, plus a very high EPSS percentile, though exploitation requires user interaction and no KEV listing exists.

What it is

Oracle E-Business Suite's Common Applications Calendar component (versions 12.1.1-12.1.3 and 12.2.3-12.2.10) contains an easily exploitable vulnerability reachable over HTTP by an unauthenticated attacker. Successful exploitation requires human interaction from someone other than the attacker, and the scope change means other products can be significantly impacted. It matters because it exposes critical data and allows limited data modification in a widely deployed ERP suite.

Impact

An attacker can gain unauthorized access to critical data or complete access to all Common Applications Calendar accessible data, plus unauthorized insert, update or delete access to some of that data. Confidentiality impact is high and integrity impact is low, with no availability impact.

Attack surface

Reached over the network via HTTP with no authentication required, but exploitation requires user interaction by a person other than the attacker, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C. The record does not describe the specific interaction or entry point.

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS is 0.59321 (99.075th percentile), indicating a high predicted likelihood of exploitation activity within 30 days.

What to do

• Apply the Oracle January 2021 Critical Patch Update (cpujan2021) for Oracle E-Business Suite Common Applications Calendar.
• Upgrade or migrate off affected versions 12.1.1-12.1.3 and 12.2.3-12.2.10 where feasible.
• Restrict network access to the E-Business Suite HTTP interface to trusted users and networks.
• Warn users against interacting with unsolicited links or content that could trigger the required user interaction.
• Monitor E-Business Suite access and audit logs for anomalous calendar data reads or writes.

Detection

• Review E-Business Suite HTTP access logs for unusual or unexpected requests to Common Applications Calendar endpoints.
• Audit database and application logs for unauthorized reads or insert/update/delete activity on Calendar data.
• Correlate user interaction events with subsequent anomalous Calendar access to identify exploitation attempts.
• Track Oracle CPU compliance for E-Business Suite hosts and flag unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.