CVE-2026-21972: 
NixOS vulnerability analysis and mitigation

CVE-2026-21972 is an information disclosure vulnerability in the Oracle Configurator product of Oracle E-Business Suite, specifically affecting the User Interface component. It impacts supported versions 12.2.3 through 12.2.15. The vulnerability allows unauthenticated attackers with network access via HTTP to gain unauthorized read access to a subset of Oracle Configurator accessible data. It was published on January 20, 2026, and addressed in Oracle's January 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle CPU Jan 2026, Red Hat CVE).

The vulnerability resides in the User Interface component of Oracle Configurator and is classified as an information disclosure flaw. It is easily exploitable with no authentication, no user interaction, and low attack complexity required — an attacker only needs network access via HTTP. The root cause is not publicly detailed by Oracle, which follows its standard policy of not disclosing granular vulnerability analysis; however, the attack vector and impact pattern are consistent with improper access control or insufficient authorization checks on UI endpoints (CWE-284 or similar). No public technical write-ups or proof-of-concept code have been identified (Oracle CPU Jan 2026).

Successful exploitation results in unauthorized read access to a subset of data accessible within Oracle Configurator, impacting confidentiality only — there is no impact to system integrity or availability. The exposed data may include configuration data, product rules, or other business-sensitive information managed within the Oracle E-Business Suite environment. Lateral movement potential is limited given the read-only nature of the vulnerability, but exposed data could aid further reconnaissance or targeted attacks against the broader E-Business Suite deployment (Oracle CPU Jan 2026).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE).

Oracle has released patches for this vulnerability as part of the January 2026 Critical Patch Update (CPU), applicable to Oracle Configurator versions 12.2.3 through 12.2.15. Organizations should apply the CPU patches immediately to all affected instances. As a temporary measure, Oracle recommends blocking network protocols required by the attack (HTTP access to Oracle Configurator) at the network level, and restricting access to trusted networks and users only. Implementing web application firewall (WAF) rules to detect anomalous HTTP requests to Oracle Configurator endpoints is also advisable until patching is complete (Oracle CPU Jan 2026).