What is the CVSS score of CVE-2026-46975?

CVE-2026-46975 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Database Server CVE-2026-46975

EUVD-2026-46468 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-f555-79vh-c3r7

Authentication Bypass Oracle Oracle Database Server Oracle Corporation

5.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

vuln.today AI

5.8 MEDIUM

Oracle Net listener is network-exposed by default with no auth barrier (AV:N/PR:N); scope change reflects cross-component data integrity impact; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:00 vuln.today

CVE Published

Jul 21, 2026 - 21:32 nvd

MEDIUM 5.8

DescriptionCVE.org

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS accessible data. CVSS 3.1 Base Score 5.8 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N).

AnalysisAI

Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-accessible attackers to perform unauthorized data manipulation - INSERT, UPDATE, or DELETE - against RDBMS-accessible data via Oracle Net. The CVSS vector (S:C) confirms a scope change, meaning successful exploitation may cascade to additional products or components beyond the targeted database instance. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the zero-barrier network entry (PR:N, AC:L, UI:N) across three actively supported Oracle release families represents a meaningful priority for internet-exposed or multi-tenant Oracle Database environments.

Technical ContextAI

Oracle Database Server's RDBMS component is the core relational engine communicating over Oracle Net (formerly SQL*Net), a proprietary protocol that defaults to TCP port 1521. The affected CPE (cpe:2.3:a:oracle_corporation:oracle_database_server) spans all three release families: 19c (long-term support), 21c (innovation), and 23ai. Although no CWE is assigned, the ENISA EUVD tag 'Authentication Bypass' - consistent with the PR:N CVSS vector - indicates the flaw likely resides in the Oracle Net listener or RDBMS authentication handshake layer, allowing unauthenticated protocol-level access to exercise DML operations. The CVSS S:C scope change flag signals that the vulnerable RDBMS component can affect a security principal beyond itself, such as a dependent application tier, linked database instance, or Oracle-integrated middleware consuming RDBMS data.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for all affected release lines - 19c, 21c, and 23ai. Exact patched version numbers are not independently confirmed in the available data and must be verified from Oracle's patch availability matrix in the CPU advisory before deployment. Where immediate patching is not feasible, restrict Oracle Net listener access (default TCP port 1521, or the configured listener port) to only trusted application server IP ranges using host-based firewall rules or Oracle Connection Manager, directly neutralizing the AV:N/PR:N attack vector; note this does not close the underlying vulnerability and must be maintained until patching completes. Additionally, enable Oracle's valid node checking by setting sqlnet.valid_node_checking_registration=ON in sqlnet.ora to prevent unauthorized host registration with the listener. These compensating controls reduce but do not eliminate risk - they depend on accurate IP allowlisting, which may be difficult in DHCP or cloud-native environments.