Note that it was an almost 4 year old already disclosed CVE which was used. Oracle messed up, big time. That's why they're trying to get rid of all incriminating evidence for potential lawsuits.

https://nvd.nist.gov/vuln/detail/cve-2021-35587