What is the CVSS score of CVE-2026-47039?

CVE-2026-47039 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Oracle Database Server CVE-2026-47039

EUVD-2026-46526 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-74p6-xcwp-mh8m

Authentication Bypass Java Oracle Oracle Database Server Oracle Corporation

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

CREATE SESSION privilege confirms PR:L; Java VM data manipulation bounded to the database instance yields S:U and C:N, A:N with only integrity affected.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:45 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding only the Create Session privilege to arbitrarily create, delete, or modify critical data or all Java VM-accessible data within the database. All three actively supported release lines are affected - 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2 - as confirmed in Oracle's July 2026 Critical Patch Update. Oracle explicitly characterizes this as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected component is the Java VM embedded within Oracle Database Server, Oracle's in-database Java execution environment that allows stored procedures, triggers, and application logic to run JVM bytecode directly inside the database engine. This component is installed by default in full Oracle Database editions and is accessed via Oracle Net, Oracle's proprietary client/server protocol stack. The CPE identifier cpe:2.3:a:oracle_corporation:oracle_database_server:*:*:*:*:*:*:*:* covers all platforms and editions across the affected version ranges. No CWE is disclosed by Oracle (listed N/A), which is standard practice in Oracle CPU advisories; however, the intelligence tag 'Authentication Bypass' suggests the flaw may permit a low-privileged Java VM session to circumvent internal access controls that should restrict which data operations a CREATE SESSION-only account can perform, effectively escalating data manipulation capabilities beyond what the account's privilege level should allow.

RemediationAI

The primary remediation is to apply the patches released under the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Patch available per vendor advisory; exact patched build numbers must be obtained from the CPU patch matrix specific to your Oracle Database edition and platform, as these are not independently verifiable from the intelligence data provided here. If immediate patching is not operationally feasible, a targeted compensating control is to audit and restrict CREATE SESSION grants to only accounts with a verified operational need, reducing the pool of accounts that can attempt exploitation. Additionally, Oracle Database administrators can disable the Java VM component using DBMS_JAVA procedures if Java stored procedures and triggers are not in use - note this will break any application logic that relies on in-database Java execution, so impact assessment is required before disabling. Network-layer controls limiting Oracle Net listener access (default TCP/1521) to trusted application server IP ranges reduce exposure from external or lateral-movement scenarios but do not mitigate risk from already-credentialed insiders.