EUVD-2026-46531
GHSA-qv2m-wjh4-mv79
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Vendor-provided vector is consistent with description: high privilege required (PR:H), mandatory user interaction (UI:R), network delivery via Oracle Net (AV:N), full triad impact on JDBC, no scope change (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows high privileged attacker having None privilege with network access via Oracle Net to compromise JDBC. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JDBC. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operating via Oracle Net, contingent on inducing human interaction from a separate party. All three actively maintained Oracle Database release tracks - 19c, 21c, and 23ai - are confirmed affected across their respective patch set ranges. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete confidentiality, integrity, and availability compromise of the JDBC layer.
Technical ContextAI
Oracle Database Server's JDBC (Java Database Connectivity) component provides the Java API layer for client-to-database communication, operating over Oracle Net - Oracle's proprietary network protocol stack that underlies SQL*Net/TNS. The vulnerability resides within this JDBC component as exposed via Oracle Net, meaning the attack surface is the database's network listener rather than a web or application tier. The CPE string cpe:2.3:a:oracle_corporation:oracle_database_server confirms this is Oracle Corporation's core relational database engine, covering the 19c, 21c, and 23ai (formerly 23c) release families. No CWE has been assigned by Oracle or NVD, which limits root-cause classification - the specific coding defect class (e.g., deserialization, injection, logic flaw within the JDBC protocol handler) cannot be confirmed from available data. The tags suggest an information disclosure angle, but the CVSS impact metrics (C:H/I:H/A:H) indicate full triad compromise, which may reflect secondary effects of JDBC takeover rather than a simple read-only disclosure.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU mechanism delivers fixes as patch sets targeting versions above the affected ceiling within each release track (19c, 21c, 23ai); consult the CPU documentation to identify the specific patched patch set level for your installed release, as exact fixed version numbers beyond the CPU advisory are not independently confirmed in the available data. As a compensating control while patching is scheduled, restrict Oracle Net listener access to the JDBC endpoint via network ACLs or Oracle Connection Manager (CMAN) so that only explicitly authorized, trusted client hosts can reach the database listener - this reduces the network attack surface but does not eliminate the vulnerability and may disrupt legitimate application connectivity if not scoped carefully. Additionally, audit and reduce the number of accounts holding high-privileged database roles, as PR:H is a hard prerequisite for exploitation.
More in Oracle Database Server
View allNet Service takeover in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated remote attackers reaching t
Full database takeover in Oracle Database Server's RDBMS component allows an authenticated, low-privileged user with onl
Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticat
Remote denial of service in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated network attackers to cr
Remote denial-of-service in Oracle Database Server's Net Service component (versions 23.4.0 through 23.26.2) allows unau
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to comp
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding o
Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, dele
Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-a
Confidentiality breach in the JDBC component of Oracle Database Server allows an unauthenticated attacker positioned on
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via netwo
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected
Share
External POC / Exploit Code
Leaving vuln.today