CVE-2021-2198: Oracle Knowledge Management unauthenticated data access via HTTP

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.2 with network reachability and no authentication, combined with a very high EPSS score, makes this a high-priority patch despite the required user interaction and lack of KEV listing.

What it is

Oracle Knowledge Management (Setup, Admin component) in Oracle E-Business Suite 12.1.1-12.1.3 and 12.2.3-12.2.10 contains an easily exploitable flaw reachable over HTTP by an unauthenticated attacker. The record does not specify the underlying weakness (CWE is listed as insufficient information), but the CVSS vector indicates high confidentiality impact and low integrity impact with scope change. Because the component is exposed over the network and requires no credentials, it is a meaningful target for data theft and tampering.

Impact

An attacker can gain unauthorized access to critical data or complete access to all Oracle Knowledge Management accessible data, plus unauthorized update, insert or delete access to some of that data. The scope change in the vector means other products may also be significantly impacted.

Attack surface

Reached over the network via HTTP against Oracle Knowledge Management; no authentication is required (PR:N), but successful exploitation requires human interaction from a person other than the attacker (UI:R).

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high at 0.799 (99.6th percentile), indicating strong predicted likelihood of exploitation activity.

What to do

• Apply the Oracle April 2021 Critical Patch Update referenced in the vendor advisory, which covers Knowledge Management 12.1.1-12.1.3 and 12.2.3-12.2.10.
• Restrict network access to Oracle E-Business Suite HTTP endpoints to trusted users and networks; do not expose Knowledge Management directly to the internet.
• Enforce user awareness and phishing-resistant controls, since exploitation requires a victim to interact with attacker-supplied content.
• Monitor and limit privileges on Knowledge Management data so that a compromise cannot cascade to other products via the scope change.
• Verify patched versions after upgrade and re-scan exposed EBS instances for the affected component.

Detection

• Review HTTP access logs for anomalous requests to Knowledge Management Setup/Admin endpoints, especially from unauthenticated or unexpected source IPs.
• Alert on unusual read, insert, update or delete activity against Knowledge Management tables and records outside normal business patterns.
• Correlate web requests with user interaction events to identify cases where a user was directed to attacker-controlled content before suspicious Knowledge Management access.
• Monitor for outbound or lateral connections from EBS hosts to unfamiliar destinations that could indicate post-exploitation movement.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.