Oracle XML Database vulnerabilities

5 CVEs affecting Oracle XML Database, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21999, published 2026-04-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-2329, published 2021-07-21. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged…
CVE-2021-2333, published 2021-07-21. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged…
CVE-2024-21242, published 2024-10-15. Low severity, CVSS 3.5. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Easily exploitable vulnerability allows low…
CVE-2025-30694, published 2025-04-15. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Easily exploitable vulnerability allows low…
CVE-2026-21999, published 2026-04-21. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.1. Difficult to exploit vulnerability allows unauthenticated attacker…