CVE-2021-26271: Ckeditor

Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days.

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

Affected products

• Ckeditor Ckeditor: from 4.0, before 4.16 (fixed in 4.16)
• Oracle Agile Product Lifecycle Management: version 9.3.5 only; version 9.3.6 only
• Oracle Application Express: before 21.1.0 (fixed in 21.1.0)
• Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6, up to and including 8.0.9; version 8.1.0 only; version 8.1.1 only
• Oracle Jd Edwards Enterpriseone Tools: before 9.2.6.0 (fixed in 9.2.6.0)
• Oracle Siebel UI Framework: before 21.9 (fixed in 21.9)
• Oracle Webcenter Sites: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2021-01-26. Last modified 2026-08-25.