Security readout for executives and security teams
Plain-English summary
This Oracle Database 21c issue affects the Zero Downtime DB Migration to Cloud component. An attacker already holding high privileges and local logon access on the migration infrastructure could take over that component, with possible impact beyond it. This is serious for environments using Oracle migration tooling, but the source bundle does not show remote or public exploitation.
Executive priority
Prioritize remediation for Oracle 21c environments using migration infrastructure. The access requirement reduces broad internet exposure, but successful exploitation can fully compromise the affected component and may affect additional products, making this high impact in enterprise database operations.
Technical view
CVE-2021-35599 is a local, low-complexity, high-privilege vulnerability in Oracle Database Server’s Zero Downtime DB Migration to Cloud component for 21c. Oracle reports scope change and high confidentiality, integrity, and availability impact, with CVSS 3.1 score 8.2: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Likely exposure
Exposure is most likely where Oracle Database Enterprise Edition 21c is deployed with Zero Downtime DB Migration to Cloud infrastructure. Risk depends on whether highly privileged local users can log on to systems where that component executes.
Exploitation context
The provided sources describe easy exploitation after high-privileged local logon access. They do not provide exploit details, public exploitation evidence, or a CISA KEV listing. Treat this as a post-access privilege-impact issue rather than an unauthenticated internet-facing flaw.
Researcher notes
The bundle provides vendor-level impact and CVSS data but no CWE, root cause, exploit detail, or named workaround. Scope is changed, so validation should include adjacent Oracle products or services relying on the migration component, while avoiding assumptions not confirmed by Oracle.
Mitigation direction
- Review Oracle October 2021 Critical Patch Update guidance for this CVE.
- Apply Oracle-supported patches or updates for affected 21c deployments.
- Restrict high-privileged local logon access to migration infrastructure.
- Harden and monitor systems where Zero Downtime DB Migration to Cloud executes.
- Check current Oracle advisories if patch applicability is unclear.
Validation and detection
- Inventory Oracle Database Enterprise Edition 21c deployments.
- Identify hosts running Zero Downtime DB Migration to Cloud components.
- Verify relevant Oracle CPU fixes are applied per vendor guidance.
- Review privileged local accounts with access to migration infrastructure.
- Check security logs for unexpected privileged local logons.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-35599 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H1.56Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.