What is the CVSS score of CVE-2026-35229?

CVE-2026-35229 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle Database are affected by CVE-2026-35229?

Oracle Database Server's Java VM component (versions 19.3-19.30, 21.3-21.21) contains a remote, unauthenticated vulnerability allowing unauthorized access to all database contents.

How to fix or mitigate CVE-2026-35229?

Within 24 hours, conduct inventory of all Oracle Database deployments to identify instances running versions 19.3-19.30 or 21.3-21.21 and classify the sensitivity of data in these systems. Within 7 days, restrict network access to Oracle Net port 1521 via firewall rules, implement network segmentation to isolate affected database systems, and enable database activity monitoring with alerts for anomalous data access patterns. Within 30 days of the April 2026 Oracle Critical Patch Update release, apply the update to all affected instances per the official patch advisory and verify all vulnerable database versions are successfully updated.

Oracle Database CVE-2026-35229

EUVD-2026-24432 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

Authentication Bypass Oracle Java Oracle Database Server

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated attack over Oracle Net with low complexity (AV:N/AC:L/PR:N/UI:N); impact is confidentiality-only read access, so C:H with I:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:06 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24432

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.30 and 21.3-21.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java VM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to compromise the Java VM over Oracle Net (default port 1521) and read all data accessible to it, affecting versions 19.3-19.30 and 21.3-21.21. The flaw is rated CVSS 7.5 with confidentiality-only impact and is easily exploitable per Oracle, though EPSS is very low (0.03%, 9th percentile) and no public exploit identified at time of analysis. It is addressed in the Oracle Critical Patch Update of April 2026.

Technical ContextAI

The affected component is the Oracle Java VM (OJVM), the Java runtime embedded inside the Oracle Database engine that executes stored Java procedures and enables Java-based database logic. Exposure occurs over Oracle Net (TNS), Oracle's proprietary client-server network protocol typically listening on TCP 1521. The vulnerability is classified as CWE-284 (Improper Access Control), meaning the OJVM fails to properly restrict who or what can access protected Java VM resources, and the supplied 'Authentication Bypass' tag reinforces that access controls guarding the Java VM can be circumvented without valid credentials. The single CPE provided (cpe:2.3:a:oracle_corporation:oracle_database_server:*) confirms the scope is the database server product line rather than clients or middleware.

RemediationAI

Apply the Oracle Critical Patch Update of April 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html); an exact fixed sub-version is not enumerated in the provided data, so identify the corresponding 19.x/21.x CPU patch for your installed release and apply it - the fix versions should be confirmed directly from that advisory. Where immediate patching is not possible, reduce exposure by restricting network access to the Oracle Net listener (TCP 1521) so it is reachable only from trusted application hosts via firewall rules or Oracle Net valid node checking (tcp.validnode_checking / tcp.invited_nodes), which limits who can reach the Java VM but requires an accurate allow-list of clients and can break legitimate connections if misconfigured. If Java in the database is not used, consider removing or disabling the OJVM component per Oracle's documented procedure, noting this will break any stored Java procedures and must be validated against application dependencies.