« Volver al listado

CVE-2026-21991

Estado: AnalizadaMedia (5.5)—

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oracle — Linux

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-21991",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-21991",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-17T13:35:15.508371Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert_us@oracle.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Linux",
          "versions": [
            {
              "status": "affected",
              "version": "8"
            },
            {
              "status": "affected",
              "version": "9"
            },
            {
              "status": "affected",
              "version": "10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-16T22:16:18.397",
  "references": [
    {
      "url": "https://linux.oracle.com/cve/CVE-2026-21991.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert_us@oracle.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names."
    },
    {
      "lang": "es",
      "value": "Un componente de DTrace, dtprobed, permite la creación arbitraria de archivos mediante nombres de proveedores USDT manipulados."
    }
  ],
  "lastModified": "2026-06-17T10:19:19.123",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:oracle:linux:8:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA9021D6-6027-42E9-A12D-7EA32C5C63F1"
            },
            {
              "criteria": "cpe:2.3:o:oracle:linux:9:0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C848CA1D-A42D-4AF1-9D95-E6268F9C1880"
            },
            {
              "criteria": "cpe:2.3:o:oracle:linux:10:0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F606DC6-31B5-4102-B174-D565662C4829"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com"
}