CVE-2021-2161
Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key facts
- CVSS score
- 5.9 (v3.1)
- Severity
- MEDIUM
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N- EPSS score
- 3.5% (89th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2021-16620)
- Published
- April 22, 2021
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2021-16620 in the EU Vulnerability Database. Last updated in EUVD on September 26, 2024.
View on the EU Vulnerability DatabaseAffected products
- debian / debian linux
- debian / debian linux
- fedoraproject / fedora
- fedoraproject / fedora
- fedoraproject / fedora
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- mcafee / epolicy orchestrator
- netapp / active iq unified manager
- netapp / active iq unified manager
- netapp / hci compute node
- netapp / hci management node
- netapp / hci storage node
- netapp / solidfire
- oracle / graalvm
- oracle / graalvm
- oracle / graalvm
- oracle / jdk
- oracle / jdk
- oracle / jdk
- oracle / jdk
- oracle / jre
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
- oracle / openjdk
and 93 more…
Certified products that may be affected
2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- McAfee Application Control v5.0, Change Control v5.0, and Integrity Monitor v5.0 with McAfee Agent v4.5 and ePolicy Orchestrator v4.5 - McAfee, Inc. - Common Criteria 383-4-153 - archived
- McAfee VirusScan Enterprise v8.5i and McAfee ePolicy Orchestrator v3.6 - McAfee, Inc. - Common Criteria CCEVS-VR-0047-2007 - archived
References
- https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposures(Third Party Advisory)
- https://kc.mcafee.com/corporate/index?page=content&id=SB10366(Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2021/04/msg00021.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/
- https://security.gentoo.org/glsa/202209-05(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20210513-0001/(Third Party Advisory)
- https://www.debian.org/security/2021/dsa-4899(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuapr2021.html(Patch, Vendor Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain