Oracle MCP Server Helper Tool CVE-2026-35228

Requires authenticated access with low-level privileges (PR:L) to Oracle MCP Server Helper Tool's HTTP interface and successful social engineering to achieve user interaction (UI:R) with attacker-controlled content. The helper tool component must be network-accessible via HTTP (AV:N). Critical limitation: the CVSS vector specifies PR:L (authenticated) while the description claims 'unauthenticated attacker' - Oracle advisory must be consulted to resolve this conflict, as the actual authentication requirement fundamentally changes the attack surface. User interaction requirement (UI:R) means the vulnerability cannot be exploited through fully automated scanning, requiring the attacker to either compromise an authenticated session or convince a legitimate low-privileged user to trigger the malicious SQL payload. The changed scope (S:C) suggests default configuration allows SQL execution with higher privileges than the authenticated user's authorization level.

The CVSS score of 8.7 (High) reflects serious potential impact, driven primarily by the changed scope (S:C) and dual high impact to confidentiality and integrity (C:H/I:H). However, real-world risk must consider multiple limiting factors. The attack requires authenticated access (PR:L) and user interaction (UI:R), significantly reducing the attack surface compared to unauthenticated remote vulnerabilities. The CVSS vector contradicts the description: the vector specifies PR:L (low-privileged authenticated) while the description states 'unauthenticated attacker' - this discrepancy must be verified with Oracle's official advisory. No EPSS score, CISA KEV listing, or public proof-of-concept has been identified, suggesting limited or no active exploitation to date. The SSVC framework would likely classify this as requiring scheduled remediation rather than immediate emergency patching due to lack of public exploitation and the authentication prerequisite. Organizations should prioritize patching based on whether they expose the helper tool's HTTP interface to low-trust authenticated users. The cross-scope impact suggests the tool may execute SQL with higher privileges than the authenticated user, making this more severe in multi-tenant or privilege-separated environments.

A low-privileged authenticated attacker crafts a malicious HTTP request containing SQL injection payloads and socially engineers a legitimate user to trigger the request through the helper tool interface, perhaps via a phishing link or embedded content in a shared workspace. When the victim interacts with the malicious content, the helper tool processes the attacker's SQL payload without proper sanitization, executing arbitrary database queries that extract sensitive data or modify records with privileges beyond the attacker's authorization level. The cross-scope impact allows the attacker to potentially access database resources outside the helper tool's intended boundaries.