Oracle Database Server CVE-2026-47038

Exploitation requires a high-privileged Oracle database account (PR:H per the vendor-provided CVSS 3.1 vector), such as a DBA or account with equivalent database-level authority, with network connectivity to the Oracle Net listener. The vulnerability affects Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2; systems running patched CPU releases within these branches are not affected. The 'Authentication Bypass' tag in the source data introduces an unresolved conflict with the PR:H CVSS metric: if this tag accurately reflects a bypass of authentication or authorization controls that effectively lowers the privilege bar, exploitation conditions may be broader than the score represents - this must be confirmed against Oracle's advisory. No non-default configuration setting is specified as a prerequisite in the description. Exploitation is limited by the high-privilege requirement in its documented form, and impact is bounded to partial unauthorized write access with no confidentiality or availability compromise.

The CVSS 3.1 base score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) places this firmly in the low-severity tier, primarily because exploitation requires a high-privileged database account (PR:H), substantially narrowing the attacker population to DBAs, compromised administrator credentials, or malicious insiders. The sole impact is partial integrity loss - unauthorized write operations - with no confidentiality or availability effects. There is a notable discrepancy between the CVSS PR:H metric and the 'Authentication Bypass' tag in the source data: if a genuine authentication bypass is present that reduces the effective privilege requirement, real-world exploitability could be significantly broader than the score implies. This conflict is unresolved from available data and should be verified against the Oracle CPU advisory. No EPSS score or KEV listing was provided, and no public exploit code has been identified, consistent with the low-severity designation. This is not a high-priority remediation target unless the 'Authentication Bypass' tag is confirmed to represent a privilege escalation path.

An attacker who has obtained DBA-level Oracle database credentials - through phishing, credential stuffing, or insider access - connects remotely over Oracle Net and exploits the RDBMS authorization flaw to perform unauthorized insert, update, or delete operations on data the account should not be permitted to modify. Because no user interaction or special configuration trigger is required beyond the high-privilege session, the manipulation could occur silently against database tables outside the attacker's intended access scope.