How severe is CVE-2021-35689?

CVE-2021-35689 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-35689 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-35689?

CVE-2021-35689 affects Oracle Talent Acquisition Cloud. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-35689?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2021-35689 published?

CVE-2021-35689 was published on 2022-02-24 and last updated on 2026-06-17.

CVE-2021-35689

CVE-2021-35689 is a critical-severity vulnerability in Oracle Talent Acquisition Cloud with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 2% (79th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Oracle Talent Acquisition Cloud
Published: 2022-02-24
Last modified: 2026-06-17

Description

A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. This high severity potential vulnerability allows attackers to perform remote code execution on Taleo Enterprise Edition system. Successful attacks of this vulnerability can result in unauthorized remote code execution within Taleo Enterprise Edition and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. All affected customers were notified of CVE-2021-35689 by Oracle.

Frequently asked questions

What is CVE-2021-35689?: A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. This high severity potential vulnerability allows attackers to perform remote code execution on Taleo Enterprise Edition system. Successful attacks of this vulnerability can result in unauthorized remote code execution within Taleo Enterprise Edition and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. All affected customers were notified of CVE-2021-35689 by Oracle.
How severe is CVE-2021-35689?: CVE-2021-35689 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-35689 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-35689?: CVE-2021-35689 affects Oracle Talent Acquisition Cloud. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-35689?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2021-35689 published?: CVE-2021-35689 was published on 2022-02-24 and last updated on 2026-06-17.

References

https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html

Affected products (1)

cpe:2.3:a:oracle:talent_acquisition_cloud:-:*:*:*:taleo_enterprise:*:*:*