What is the CVSS score of CVE-2026-47038?

CVE-2026-47038 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Database Server CVE-2026-47038

EUVD-2026-46525 LOW

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-hrr6-x47r-mj88

Authentication Bypass Oracle Oracle Database Server Oracle Corporation

2.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.7 LOW

Network-accessible via Oracle Net with no interaction needed; PR:H reflects required DBA-level credentials; integrity-only partial impact aligns with described unauthorized write scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:44 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

LOW 2.7

DescriptionCVE.org

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows high privileged attacker having None privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).

AnalysisAI

Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected attacker to perform insert, update, or delete operations against a subset of data accessible within the database. Affected versions span the 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2 release trains, all reachable over Oracle Net without user interaction. No public exploit has been identified at time of analysis; with a CVSS 3.1 score of 2.7 and integrity-only impact, the risk is primarily relevant to environments where high-privileged database credentials may be compromised or misused.

Technical ContextAI

The vulnerability resides in the RDBMS core component of Oracle Database Server, which is accessed over Oracle Net - Oracle's proprietary client-server network transport layer enabling remote database connectivity. The affected product is identified by CPE cpe:2.3:a:oracle_corporation:oracle_database_server across three supported long-term release branches. No CWE has been assigned by the reporter, but the 'Authentication Bypass' tag suggests the root cause may involve improper authorization enforcement within the database engine - potentially allowing a high-privileged session to operate outside its intended data access scope. The network-facing Oracle Net listener is the attack surface, meaning any host with TCP reachability to the database port is a potential entry point for a suitably credentialed attacker.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle bundles database patches in quarterly CPUs rather than publishing standalone fix versions, so administrators must consult the advisory matrix to identify the appropriate patch set for their specific release (19.x, 21.x, or 23.x). Exact patched version numbers are not independently confirmed from available data beyond the CPU reference. As a compensating control for unpatched environments, restrict network access to the Oracle Net listener (default TCP 1521) to explicitly trusted client hosts using firewall rules or Oracle's Valid Node Checking (sqlnet.ora VALID_NODE_CHECKING_REGISTRATION) - this reduces the pool of potential attackers without disabling database functionality, though it does not eliminate risk from trusted compromised hosts. Additionally, audit and rotate high-privileged database account credentials and review DBA-level activity logs to detect anomalous data modification attempts.