Oracle Database Server CVE-2026-47039

The attacker must hold a valid Oracle Database account with at minimum the CREATE SESSION system privilege, which is the lowest possible privilege level and is granted to any user permitted to establish a database connection. The Java VM component must be installed and enabled in the target database instance - it is present by default in full Oracle Database installations but may be absent in custom minimal installs. Network access to the Oracle Net listener (typically TCP port 1521) is required. No user interaction is needed and attack complexity is low per Oracle's advisory. Exploitation is limited by the following factors: the attacker must have a valid database credential, since unauthenticated access is not possible (PR:L per CVSS); the integrity impact is bounded to Java VM-accessible data within the specific database instance (S:U, no cross-system scope change); and there is no confidentiality or availability impact, restricting the attack exclusively to data integrity. The 'Authentication Bypass' metadata tag may indicate that the flaw permits the Java VM session to bypass internal privilege checks governing which data it can manipulate, but authentication to the database itself remains a hard prerequisite.

The CVSS 3.1 base score of 6.5 places this in the Medium band, but several qualitative signals push practical risk above what the score alone conveys. Oracle's advisory language - 'easily exploitable' - indicates low attack complexity is not a conservative estimate. The privilege requirement is CREATE SESSION, the most rudimentary Oracle system privilege granted to any user who can log into the database, meaning the effective attacker population includes every valid database account holder, not just privileged users. The integrity impact is rated High, covering unauthorized creation, deletion, and modification of critical data or all Java VM-accessible data, which can encompass business-critical application tables. No EPSS probability, KEV listing, or public POC was supplied in the provided intelligence, so community-derived exploitation likelihood cannot be quantified. The 'Authentication Bypass' tag introduces a notable ambiguity: if this accurately characterizes the root cause, the effective exploitation threshold may be lower than the PR:L metric implies, potentially enabling privilege escalation within the Java VM context. Mitigating factors are that scope is Unchanged (S:U), bounding impact to the target database instance, and there is no confidentiality or availability impact, so data exfiltration and service disruption are not direct consequences of this CVE. Overall, the combination of network accessibility, low privilege requirement, and Oracle's own 'easily exploitable' characterization makes this a meaningful patch priority for any organization running Oracle Database with Java VM enabled.

An attacker who possesses any valid Oracle Database account - for example, a credential obtained through phishing, credential stuffing, or insider access - connects to the Oracle Net listener over the network and issues a crafted request targeting the Java VM component. No public exploit code has been identified at time of analysis, but Oracle's characterization of the vulnerability as 'easily exploitable' with low complexity suggests minimal reverse-engineering effort is required once a valid credential is in hand. Upon successful exploitation, the attacker gains the ability to insert, update, or delete rows in tables accessible through the Java VM, potentially corrupting or destroying business-critical data without possessing DBA or schema-owner privileges.