Security readout for executives and security teams
Plain-English summary
CVE-2021-35567 is a Java and Oracle GraalVM Enterprise Edition vulnerability that can expose sensitive data. It matters most where affected Java runtimes process untrusted code or untrusted Kerberos-related API input. The source bundle does not show active exploitation.
Executive priority
Patch during the next normal security maintenance window, sooner for exposed Java services or legacy Java client workflows. The business risk is mainly confidentiality loss, not service outage, and the provided sources do not show active exploitation.
Technical view
Oracle describes a Libraries component flaw affecting Java SE 8u301, 11.0.12, 17 and GraalVM EE 20.3.3, 21.2.0. CVSS is 6.8: network reachable, low complexity, low privileges, user interaction required, changed scope, high confidentiality impact only.
Likely exposure
Exposure is most likely in legacy Java client deployments using sandboxed Java Web Start or applets, or Java services that pass untrusted data into the affected component APIs. Bundled Java runtimes in third-party products should also be checked against vendor advisories.
Exploitation context
The source bundle says exploitation can occur over Kerberos and requires human interaction. It does not include exploit details, public exploitation evidence, or CISA KEV listing. Treat this as plausible but not confirmed active exploitation.
Researcher notes
Focus validation on runtime version evidence and reachable data paths into the Libraries component. The advisory text names Kerberos and sandboxed/untrusted-code scenarios, but the bundle does not provide CWE mapping, root-cause detail, exploit artifacts, or product-specific impact beyond listed versions.
Mitigation direction
- Apply Oracle October 2021 CPU guidance for affected Oracle Java and GraalVM EE versions.
- Use operating system vendor OpenJDK security updates where Java is supplied by the distribution.
- Inventory and reduce sandboxed Java Web Start or applet exposure to untrusted code.
- Check third-party product advisories for bundled Java runtime remediation guidance.
- Prioritize systems processing untrusted Kerberos-related input through Java APIs.
Validation and detection
- Identify installed Java SE, JDK, JRE, OpenJDK, and GraalVM EE versions.
- Confirm affected versions are not present in production or supported desktop images.
- Review applications using Java Web Start, applets, or Java sandbox assumptions.
- Review Java services handling Kerberos or untrusted API-supplied data.
- Verify vendor or distribution security updates are installed and documented.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35567 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N2.34Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20211022-0004/CVE reference · x_refsource_CONFIRM
- FEDORA-2021-7701833090CVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-1cc8ffd122CVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-107c8c5063CVE reference · vendor-advisory, x_refsource_FEDORA
- DSA-5000CVE reference · vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security updateCVE reference · mailing-list, x_refsource_MLIST
- DSA-5012CVE reference · vendor-advisory, x_refsource_DEBIAN
- GLSA-202209-05CVE reference · vendor-advisory, x_refsource_GENTOO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.