Oracle Database CVE-2026-35229

Exploitation requires network reachability to the Oracle Database Server's Oracle Net listener (typically TCP 1521) and that the target runs an affected release (19.3-19.30 or 21.3-21.21) with the Java VM/OJVM component present. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are required against a reachable listener. The practical limiting factor is exposure: the listener is normally confined to internal or application-tier networks rather than the internet, so reachability - not credentials - is the primary gate; impact is also limited to reading Java VM-accessible data (no write or availability impact).

The signals are mixed and lean toward lower real-world urgency than the 7.5 base score suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a genuinely easy remote, unauthenticated attack, and SSVC marks it Automatable:yes with partial technical impact - factors that normally raise priority. However, EPSS is only 0.03% (9th percentile), SSVC Exploitation status is 'none' (no observed or public exploitation), it is not in CISA KEV, and no public exploit identified at time of analysis. Impact is confidentiality-only (C:H, I:N, A:N): an attacker can read Java VM-accessible data but cannot modify data or disrupt availability through this flaw. The main caveat is exposure: Oracle Net/OJVM should not be internet-facing in well-managed environments, so despite the 'network' vector the practical attack surface is usually internal or partner networks. Net assessment: patch on the normal Critical Patch Update cadence rather than as an emergency, but prioritize any database with an internet-reachable listener.

An attacker with network reachability to the Oracle Net listener sends crafted traffic that abuses the Java VM's improper access control to bypass authentication and read data accessible to the OJVM, all without valid database credentials. Because CVSS complexity is low (AC:L) and no user interaction is needed, the attack is straightforward once the listener is reachable, but no public exploit identified at time of analysis and Oracle reports no observed exploitation.