Oracle Database Server CVE-2026-34312

The attacker must hold the Row Access Method privilege within the target Oracle Database instance - this is a non-default, high-privilege database permission not assigned to ordinary users and typically granted only to DBAs or specialized application accounts. Network-level access to the Oracle listener (default TCP 1521) is required via any supported Oracle protocol. A separate human interaction from a third party (i.e., not the attacker themselves) is required for the attack to succeed, meaning purely automated or fully autonomous exploitation is not possible. Exploitation is further scoped to Oracle Database Server versions 19.3 through 19.30 only. The impact is strictly confidentiality-only and limited to a subset of RDBMS-accessible data - no write access, schema modification, or denial of service is achievable through this vulnerability. The 'Authentication Bypass' tag should not be interpreted as enabling unauthenticated access; the CVSS PR:H vector confirms a high-privilege authenticated session is a hard prerequisite.

Real-world risk is low and well-characterized by converging signals. The CVSS 3.1 base score of 2.4 is among the lowest possible, driven by PR:H (requires a high-privilege database account), UI:R (requires human interaction from a third party), and C:L (only a partial confidentiality impact). EPSS at 0.03% (7th percentile) is far below any operational exploitation threshold. SSVC independently confirms: exploitation status none, not automatable, and only partial technical impact. No CISA KEV listing and no public POC exist. One notable inconsistency: the 'Authentication Bypass' tag conflicts with the PR:H CVSS vector - if this were a true authentication bypass enabling unauthenticated access, the vector would show PR:N; defenders should verify this tag against the Oracle advisory before drawing conclusions. This vulnerability warrants inclusion in the next scheduled Oracle patching cycle, not emergency remediation.

A database insider or compromised high-privilege account holding the Row Access Method privilege connects to the Oracle Database over the network and manipulates or waits for a legitimate user interaction that triggers the vulnerable RDBMS code path. Through the CWE-284 access control flaw, the attacker reads a subset of rows in a schema they are not authorized to access. No public proof-of-concept exists, restricting realistic exploitation to knowledgeable insiders or attackers who have already obtained a high-privilege Oracle account through prior compromise.