What is the CVSS score of CVE-2026-47046?

CVE-2026-47046 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Database are affected by CVE-2026-47046?

Oracle Database Server versions 23.4.0 through 23.26.2 contain a vulnerability enabling unauthenticated remote attackers to trigger database denial of service and gain unauthorized access to modify…

How to fix or mitigate CVE-2026-47046?

Within 24 hours, identify all Oracle Database Server 23.4.0-23.26.2 instances and immediately restrict network access to trusted application and administrative hosts only; confirm whether databases are currently exposed to untrusted networks. Within 7 days, deploy database activity monitoring to detect exploitation attempts including connection anomalies, unexpected transaction patterns, or database hangs; enable alerting for administrative change events. Within 30 days, coordinate with Oracle support on patch availability timelines for versions 23.4.0-23.26.2 and develop a migration plan to update affected systems once patches are released, or consider alternative database platforms if patch release timelines are unacceptable for organizational risk tolerance.

Oracle Database CVE-2026-47046

EUVD-2026-46532 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-55jc-5v44-h4j7

Denial Of Service Oracle Oracle Database Server

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

8.2 HIGH

Unauthenticated network reach to Oracle Net gives AV:N/AC:L/PR:N/UI:N; effects are complete DOS (A:H) and partial data tampering (I:L) with no confidentiality loss (C:N) and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:28 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS as well as unauthorized update, insert or delete access to some of RDBMS accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

AnalysisAI

Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticated remote attacker reach the database over Oracle Net and trigger a hang or repeatable crash, and additionally gain unauthorized update, insert, or delete access to some database-accessible data. Rated CVSS 3.1 8.2 (High) with network attack vector and low complexity, it requires no privileges or user interaction, making it easily exploitable per Oracle's advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw resides in the core RDBMS engine of Oracle Database Server, reachable through the Oracle Net (TNS) listener/session protocol that mediates all client-server database traffic on the default 1521/tcp service. Because the CPE (cpe:2.3:a:oracle_corporation:oracle_database_server) scopes only the database server application and the CVSS vector shows a scope-unchanged (S:U) network attack, the defect is exploitable by any party able to open an Oracle Net session before or without authentication. No CWE was assigned by the source, but the described effect - a low-integrity data modification combined with a high-availability crash reachable pre-auth - is consistent with an input-validation or protocol-parsing weakness in the Net/RDBMS request-handling path rather than a logic bug requiring credentials.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update advisory of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; the exact patched release for the 23.x line should be taken directly from that CPU matrix rather than assumed. Because exploitation traverses Oracle Net, the primary compensating control until patching is to restrict network reachability of the listener: limit access to the 1521/tcp (or configured) Oracle Net port via firewall/security-group rules and Oracle Net Valid Node Checking (tcp.validnode_checking / tcp.invited_nodes) so only trusted application and management hosts can open sessions, accepting that this breaks connectivity for any client not on the allowlist. Ensure no database listener is exposed to the internet, and monitor for anomalous session-establishment patterns and unexpected instance crashes as a detection layer while patches are staged.