CVE-2021-2190

What it actually does

CVE-2021-2190 is an unauthenticated, network-reachable denial-of-service vulnerability in the Template component of Oracle Sales Offline, part of Oracle E-Business Suite. A remote attacker can send crafted HTTP requests that cause the affected Sales Offline service or supporting application component to hang or repeatedly crash. The vulnerability does not provide confidentiality or integrity impact, but it can produce complete availability loss for the affected component. Affected supported versions are Oracle E-Business Suite Sales Offline 12.1.1 through 12.1.3 and 12.2.3 through 12.2.10.

Why it matters to the business

Successful exploitation can interrupt Oracle Sales Offline functionality, preventing users from accessing or synchronizing sales-related offline workflows. For organizations that rely on Oracle E-Business Suite for sales operations, this can disrupt revenue-supporting business processes, increase help desk and operations workload, and potentially cause cascading service degradation if repeated crashes affect shared application infrastructure. Although it is not listed in CISA KEV and is not known to be ransomware-associated, the EPSS score is very high, indicating elevated likelihood of exploitation activity relative to most vulnerabilities, so internet-facing or partner-accessible deployments should be treated as high priority.

How an attack unfolds

An attacker first identifies an Oracle E-Business Suite deployment exposing Oracle Sales Offline functionality over HTTP or HTTPS. Because the flaw requires no authentication, privileges, or user interaction, the attacker can directly send malicious requests to the affected Template component. The crafted traffic triggers a failure condition that causes the Sales Offline component to hang or crash. By repeating the requests, the attacker can keep the component unavailable, producing a sustained denial of service until the traffic is blocked, the service is stabilized, or the vulnerable code is patched.

How to fix it

Apply the relevant Oracle Critical Patch Update or Oracle E-Business Suite patch that remediates this vulnerability for the deployed EBS release. Oracle did not provide a simple standalone fixed product version in the supplied data, so remediation should be validated against Oracle advisory and patch documentation for the exact E-Business Suite release and patch level. If immediate patching is not possible, reduce exposure by restricting HTTP/HTTPS access to Oracle Sales Offline to trusted networks or VPN users, enforcing reverse-proxy or WAF rate limits, blocking unauthenticated access paths where business-safe, and monitoring for abnormal request spikes or repeated application-tier crashes. Ensure Oracle E-Business Suite deployments are on supported releases and current CPU patch levels, especially for versions 12.1.1-12.1.3 and 12.2.3-12.2.10.

How to confirm the fix worked

Confirm exposure by inventorying Oracle E-Business Suite instances and checking whether Oracle Sales Offline is installed or enabled on versions 12.1.1 through 12.1.3 or 12.2.3 through 12.2.10. Validate remediation by reviewing Oracle E-Business Suite Patch Wizard results, OPatch inventory, applied CPU documentation, and application tier patch records to ensure the Oracle patch containing the fix has been applied. After patching, perform a controlled functional test of Oracle Sales Offline and verify there are no repeated application-tier crashes, hangs, or HTTP 5xx responses when the component receives normal unauthenticated and authenticated requests. Also confirm that compensating controls, such as WAF rules, reverse-proxy restrictions, and network ACLs, are enforcing the intended access policy.

Typical attack path

1. Discover an Oracle E-Business Suite instance with Oracle Sales Offline exposed over HTTP or HTTPS.
2. Confirm that the deployment appears to be within an affected version range: 12.1.1-12.1.3 or 12.2.3-12.2.10.
3. Send unauthenticated crafted HTTP requests to the Sales Offline Template component.
4. Trigger a hang or crash in the affected Sales Offline service or application tier component.
5. Repeat the request pattern to keep the component down or force recurring restarts.
6. Optionally rotate source addresses or request timing to avoid simple rate-based blocking.

How to detect it

To determine whether exploitation has already occurred, review Oracle HTTP Server access and error logs, WebLogic or OACORE managed server logs, Oracle E-Business Suite application logs, JVM crash logs, load balancer logs, reverse-proxy logs, and WAF events. Focus on periods with Sales Offline outages, application hangs, managed server restarts, JVM exits, or spikes in HTTP 5xx responses. Look for high-volume or repeated unauthenticated HTTP requests targeting Sales Offline or template-related application paths immediately before crashes or service unavailability. Correlate source IPs, user agents, request paths, response codes, and timestamps with service restart events. Because no public exploit artifact or unique payload string is provided in the supplied data, detection should emphasize behavioral evidence: repeated unauthenticated access to the vulnerable component, abnormal request rates, and crash-or-hang sequences in application-tier logs.

• Oracle Sales Offline
• Sales Offline
• Template
• HTTP 500
• HTTP 502
• HTTP 503
• HTTP 504
• java.lang.OutOfMemoryError
• java.lang.StackOverflowError
• Managed Server is restarting
• OACORE
• oacore
• JVM crash
• Application Hang
• complete DOS

What your security team should do

• Prioritize patching Oracle E-Business Suite instances running affected Sales Offline versions, especially systems reachable from the internet, partners, or broad internal networks.
• Inventory all Oracle E-Business Suite deployments and determine whether Oracle Sales Offline is installed, enabled, or externally reachable.
• Apply the applicable Oracle CPU or E-Business Suite patch for the exact release; do not rely on version masking or perimeter filtering as the primary fix.
• Until patched, restrict HTTP/HTTPS access to Sales Offline functionality to trusted networks and enforce rate limiting at the WAF, reverse proxy, or load balancer.
• Alert on repeated unauthenticated requests followed by HTTP 500/502/503/504 responses, application server restarts, JVM crashes, or Sales Offline service unavailability.
• Review Oracle HTTP Server, WebLogic/OACORE, application, load balancer, and WAF logs for evidence of pre-patch exploitation attempts.
• Confirm operational runbooks include safe restart procedures and escalation paths for Oracle E-Business Suite application-tier denial-of-service events.