VulnerabilityPublished 20 Jan 2026

CVE-2026-21922: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Planning and Budgeting Cloud Service executes to compromise Oracle Planning and Budgeting Cloud Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Planning and Budgeting Cloud Service accessible data.

Affects Oracle Planning and Budgeting Cloud ServiceSource CVE Database V5

Not known to be exploited · CVSS 4.2 Medium.

Data as of 26 Oct 2026, 12:55 UTC

CVSS 3.1 base score

4.2Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: High
User Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: High: The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable component that could affect component-wide settings and files.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 20 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Oracle CorporationOracle Planning and Budgeting Cloud Service	Affected =25.04.07	Fixed in–

AI-suggested

European organizations should immediately verify the version of Oracle Planning and Budgeting Cloud Service and ensure the EPM Agent is updated to the latest patched version as recommended by Oracle. Access to the underlying infrastructure must be tightly controlled, with strict privilege management and monitoring to prevent unauthorized high privileged logons. Implement robust user awareness training to reduce the risk of successful social engineering attacks that could trigger the required human interaction. Employ multi-factor authentication and session monitoring for privileged accounts to detect and prevent misuse. Regularly audit logs and configurations of the Oracle cloud environment to identify suspicious activities. Additionally, segment the infrastructure hosting Oracle services to limit lateral movement and isolate critical components. Establish incident response plans specific to cloud service compromises involving data integrity issues. Finally, coordinate with Oracle support for any additional security advisories or mitigations.

Description

CVE-2026-21922 is a medium severity vulnerability affecting Oracle Planning and Budgeting Cloud Service version 25.04.07, specifically its EPM Agent component. It allows a high privileged attacker with infrastructure logon to compromise the service by exploiting a flaw that requires human interaction from a third party. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within the service. The vulnerability impacts data integrity but does not affect confidentiality or availability. Exploitation requires local access with high privileges and user interaction, limiting remote attack feasibility. No known exploits are currently reported in the wild. Organizations using this Oracle cloud service should update the EPM Agent promptly to mitigate risk. European entities relying on Oracle’s enterprise performance management tools are advised to prioritize patching due to potential data integrity risks.

Impact

For European organizations, this vulnerability poses a significant risk to the integrity of critical financial and operational data managed within Oracle Planning and Budgeting Cloud Service. Unauthorized data modification or deletion could disrupt budgeting, forecasting, and financial planning processes, potentially leading to erroneous business decisions, regulatory compliance issues, and financial losses. Given that the attack requires high privileged access and user interaction, the threat is more relevant in environments where insider threats or compromised privileged accounts exist. Organizations in finance, manufacturing, and public sectors using Oracle’s cloud services are particularly vulnerable. The impact is compounded by the critical nature of the data handled by the service, which often supports strategic decision-making and regulatory reporting. While confidentiality and availability are not directly impacted, the integrity compromise alone can have cascading effects on business operations and trustworthiness of financial data.

References

oracle.com/security-alerts/cpujan2026.html (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 28 Jan 2026, 20:17 UTC

Technical details

References

Community reviews

Related threats