CVE-2026-21997 affects Oracle Life Sciences Empirica Signal (versions 9.2.1 to 9.2.3) and is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product. The vulnerability can result in unauthorized creation, deletion, or modification of critical data and unauthorized read access to some data. The scope of impact may extend to additional Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact. Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory, which addresses multiple security issues across many Oracle products. The advisory emphasizes the importance of applying patches promptly but does not explicitly state patch availability or remediation details specific to this vulnerability.

The vulnerability allows attackers with low privileges and network access to perform unauthorized data creation, deletion, modification, and partial unauthorized data reading within Oracle Life Sciences Empirica Signal. This can compromise data integrity and confidentiality. Additionally, the vulnerability's scope change means it may affect other Oracle products beyond Empirica Signal. The CVSS score of 8.5 reflects a high severity due to these impacts. There are no known exploits in the wild at the time of publication.

Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory. While the advisory does not explicitly confirm patch availability for this specific vulnerability, it strongly recommends that customers apply the April 2026 Critical Patch Update promptly to address this and other vulnerabilities. Organizations using Oracle Life Sciences Empirica Signal versions 9.2.1 to 9.2.3 should review the April 2026 CPU documentation and apply relevant patches as soon as possible. Patch status is not yet confirmed explicitly for this vulnerability; therefore, check the vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest remediation guidance.