What is the CVSS score of CVE-2026-47040?

CVE-2026-47040 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Net Services are affected by CVE-2026-47040?

Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2) is vulnerable to unauthenticated remote compromise allowing attackers to read all data accessible to the database and trigger…

How to fix or mitigate CVE-2026-47040?

Within 24 hours: Inventory all Oracle Database Server instances running versions 19.3-19.31, 21.3-21.22, or 23.4.0-23.26.2 and map their network exposure. Within 7 days: Implement firewall rules restricting inbound Oracle Net traffic (TCP 1521) to known trusted hosts only; enable database activity logging and real-time alerting on unexpected connection patterns and data access attempts. Within 30 days: Engage Oracle support for interim workaround guidance; document and test your upgrade path to non-vulnerable versions; if immediate upgrades are not feasible, maintain strict compensating controls including network segmentation and continuous monitoring.

Oracle Net Services CVE-2026-47040

EUVD-2026-46527 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-9vwg-jr6q-mqf6

Authentication Bypass Oracle Oracle Net Services Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

Listener is network-reachable and pre-authentication (AV:N/PR:N/AC:L per Oracle 'easily exploitable'); data disclosure gives C:H and repeatable crash gives A:H, with no integrity impact (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:27 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Net Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

AnalysisAI

Unauthenticated remote compromise of Oracle Net Services affects Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, letting a network attacker reaching the database listener over Oracle Net (typically TCP 1521) read all data accessible to the component and hang or repeatedly crash it for a complete denial of service. Rated CVSS 3.1 9.1 with high confidentiality and availability impact and no integrity impact, it requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing nature make it a high remediation priority.

Technical ContextAI

Oracle Net Services is the connectivity layer of Oracle Database, comprising the TNS (Transparent Network Substrate) protocol, the Oracle Net Listener, and Net foundation libraries that broker all client-to-database and database-to-database sessions, normally exposed on TCP port 1521. The CPE cpe:2.3:a:oracle_corporation:oracle_net_services identifies the affected component as the Net stack itself rather than the SQL engine, meaning the flaw lives in protocol handling reachable before any database authentication occurs. Oracle assigned no CWE (listed N/A); based on the impact profile (data disclosure plus repeatable crash without integrity impact) the root cause is consistent with improper input validation or memory/state handling in the TNS protocol parser. The supplied 'Authentication Bypass' tag together with the PR:N vector indicates the attack surface is pre-authentication protocol processing.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though the input does not specify an exact fixed build number, so obtain the precise patched version and platform-specific patch ID directly from the CPU matrix for your 19c/21c/23ai release. Where immediate patching is not possible, restrict access to the Oracle Net Listener port (default TCP 1521) using network firewalls and database-side Valid Node Checking (invited_nodes/excluded_nodes in sqlnet.ora) to limit which hosts can open Net sessions - this shrinks the unauthenticated attack surface at the cost of maintaining an allowlist that can break legitimate clients if incomplete; place the listener behind a bastion or VPN so it is never directly internet-reachable; and enable listener logging and monitoring for anomalous connection or crash patterns to detect DoS attempts. These controls mitigate exposure but do not remove the underlying flaw, so patching remains the definitive fix.