Security readout for executives and security teams
Plain-English summary
CVE-2021-35619 is a high-severity Oracle Database Java VM issue. A low-privileged database user with CREATE PROCEDURE and Oracle Net access could compromise the Java VM, but exploitation is difficult and requires another person’s interaction.
Executive priority
Prioritize remediation for internet-accessible or broadly reachable Oracle databases, especially where many users have procedural privileges. The impact is takeover of Java VM, but exploitation is constrained by high complexity and required user interaction.
Technical view
The flaw affects Oracle Database Enterprise Edition Java VM in 12.1.0.2, 12.2.0.1, 19c, and 21c. CVSS 3.1 is 7.1 with network attack vector, high complexity, low privileges, required user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely where affected Oracle Database Enterprise Edition versions are reachable over Oracle Net and low-privileged users hold CREATE PROCEDURE. Systems without the affected Java VM component or without that privilege path may have reduced exposure, but the bundle does not confirm component-specific exceptions.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. Exploitation is described as difficult, requiring network access, low privileges, CREATE PROCEDURE, and human interaction from someone other than the attacker.
Researcher notes
No CWE, root-cause detail, exploit evidence, or standalone workaround is provided in the bundle. Research should stay focused on Oracle’s advisory, affected release verification, privilege exposure, Java VM presence, and patch status.
Mitigation direction
- Review Oracle October 2021 CPU guidance for the applicable database release.
- Apply current Oracle-supported security updates for affected Oracle Database versions.
- Restrict Oracle Net access to trusted networks and administrative paths.
- Review and minimize CREATE PROCEDURE grants for low-privileged users.
- Assess whether Oracle Java VM is present and required on exposed databases.
Validation and detection
- Inventory Oracle Database Enterprise Edition versions 12.1.0.2, 12.2.0.1, 19c, and 21c.
- Verify patch level against Oracle October 2021 CPU and later security updates.
- Identify users or roles with CREATE PROCEDURE on affected databases.
- Confirm Oracle Net exposure from untrusted or broad network segments.
- Document whether the Java VM component is installed and operational.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-35619 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H1.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.