PT-2026-3724 · Oracle · Oracle Zero Data Loss Recovery Appliance

Alexander Kornbrust · Published 2026-01-20 · Updated 2026-01-20 · CVE-2026-21977

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Zero Data Loss Recovery Appliance Software versions 23.1.0 through 23.1.202509

Description A difficult to exploit issue exists in the Oracle Zero Data Loss Recovery Appliance Software, specifically within the Security component. An unauthenticated attacker with network access via Oracle Net can compromise the software. Exploitation requires human interaction from someone other than the attacker and can lead to unauthorized read access to a subset of the software’s data.

Recommendations Update Oracle Zero Data Loss Recovery Appliance Software to a version later than 23.1.202509.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-00999

CVE-2026-21977

Affected Products

Oracle Zero Data Loss Recovery Appliance

References · 5

• https://bdu.fstec.ru/vul/2026-00999 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21977 · Security Note
• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://twitter.com/CVEnew/status/2013740407767642485 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB20260120150 · Note