Security readout for executives and security teams
Plain-English summary
CVE-2021-35666 affects Oracle HTTP Server 11.1.1.9.0. An unauthenticated attacker with HTTPS network access could, in difficult conditions, gain unauthorized access to sensitive data served or accessible through the server. The main business risk is confidentiality loss, not system takeover or outage based on the supplied CVSS vector.
Executive priority
Treat this as a targeted confidentiality risk for legacy Oracle HTTP Server deployments. Prioritize verification and vendor-guided remediation for internet-facing or sensitive-data-serving instances, but the available evidence does not support emergency treatment as actively exploited.
Technical view
Oracle describes an OSSL Module vulnerability in Oracle HTTP Server, part of Oracle Fusion Middleware. CVSS 3.1 is 5.9 with AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The affected supported version listed is 11.1.1.9.0. No CWE or technical root cause is provided in the source bundle.
Likely exposure
Exposure is likely limited to organizations running Oracle HTTP Server 11.1.1.9.0 with HTTPS reachable by untrusted networks. Systems not using that version, not exposing HTTPS, or not running Oracle HTTP Server are not indicated as affected by the supplied sources.
Exploitation context
The source states exploitation is difficult but unauthenticated over HTTPS. The bundle does not show CISA KEV listing or other evidence of active exploitation. Successful exploitation can expose critical data or all data accessible to Oracle HTTP Server.
Researcher notes
The public bundle gives limited technical detail: affected version, OSSL Module component, HTTPS attack vector, high attack complexity, and confidentiality-only impact. No exploit mechanics, CWE, or independent exploitation evidence are included, so validation should focus on version, exposure, and Oracle advisory alignment.
Mitigation direction
- Identify Oracle HTTP Server instances and confirm whether version 11.1.1.9.0 is present.
- Review Oracle's October 2021 Critical Patch Update guidance for applicable fixes.
- Apply only Oracle-supported patches, upgrades, or mitigations for this product.
- Restrict HTTPS access to trusted networks where operationally feasible.
- Increase monitoring around Oracle HTTP Server HTTPS access and sensitive content.
Validation and detection
- Check asset inventory for Oracle HTTP Server 11.1.1.9.0 deployments.
- Confirm whether affected servers expose HTTPS to external or untrusted networks.
- Compare patch records against Oracle's October 2021 Critical Patch Update.
- Review configuration and logs for unexpected access to sensitive server-accessible data.
- Document compensating controls if vendor remediation is not yet applied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35666 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N2.23.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.