CVE-2026-21994
Published: 17 March 2026
Description
Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component: Desktop). The supported version that is affected is 0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
more
Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit. Successful attacks of this vulnerability can result in takeover of Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the improper access control flaw (CWE-284) in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit version 0.3.0 by applying vendor patches or upgrades.
Enforces approved authorizations for logical access to system resources, directly countering the vulnerability's unauthenticated takeover via improper access control.
Monitors and controls communications at external boundaries to block unauthenticated network access via HTTP to the vulnerable Desktop component.
Security SummaryAI
CVE-2026-21994 is a high-severity vulnerability affecting the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit, a product within Oracle Open Source Projects, specifically the Desktop component in version 0.3.0. Published on 2026-03-17, it stems from CWE-284 (Improper Access Control) and carries a CVSS 3.1 Base Score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating critical impacts on confidentiality, integrity, and availability.
The vulnerability is easily exploitable by an unauthenticated attacker with network access via HTTP. Successful exploitation enables full takeover of the affected Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit instance, allowing the attacker to compromise all core security properties.
For mitigation details, refer to the Oracle security advisory at https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation over HTTP of a public-facing application, directly mapping to T1190: Exploit Public-Facing Application.