CVE-2026-21997 affects Oracle Life Sciences Empirica Signal (versions 9.2.1 to 9.2.3) and involves a vulnerability in the Common Core component that can be exploited by a low privileged attacker with network access via HTTP. The vulnerability allows unauthorized creation, deletion, or modification of critical data and unauthorized reading of some data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact. The vulnerability may also affect other Oracle products due to scope change. Oracle's April 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability in Empirica Signal. Customers are urged to apply the Critical Patch Update promptly to mitigate risks.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle Life Sciences Empirica Signal, as well as unauthorized read access to a subset of accessible data. This compromises data confidentiality and integrity but does not affect availability. The vulnerability's scope change indicates potential impact on additional Oracle products beyond Empirica Signal. No known exploits are reported in the wild currently.

Oracle's April 2026 Critical Patch Update advisory strongly recommends applying the provided security patches without delay. Although no explicit patch availability or remediation level is stated for Oracle Life Sciences Empirica Signal in the advisory content, customers should monitor the referenced advisory and Oracle support channels for patch releases and installation instructions. Maintaining actively supported versions and promptly applying Critical Patch Updates is the primary mitigation. Patch status is not yet confirmed for this specific product version; check the vendor advisory for current remediation guidance.