What is the CVSS score of CVE-2026-47060?

CVE-2026-47060 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Oracle Database Server CVE-2026-47060

EUVD-2026-46546 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-xp7q-3hqw-c4rw

Authentication Bypass Oracle Oracle Database Server Oracle Corporation

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable JDBC endpoint with no credentials required, but mandatory user interaction gates exploitation; impact is integrity-only with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:33 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JDBC. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JDBC accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).

AnalysisAI

Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, delete, or modify critical data or all JDBC-accessible data via Oracle Net. Affected releases span three supported branches: 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Exploitation requires human interaction from a party other than the attacker, limiting opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the JDBC (Java Database Connectivity) component of Oracle Database Server, which provides the programmatic interface for Java applications to interact with the Oracle RDBMS. Connections are established and managed over the proprietary Oracle Net protocol (formerly SQL*Net). The affected CPE is cpe:2.3:a:oracle_corporation:oracle_database_server:*:*:*:*:*:*:*:*, covering the three active long-term release trains. No CWE has been assigned by Oracle, but the 'Authentication Bypass' tag supplied in the intelligence metadata suggests the root cause involves a flaw in how the JDBC layer validates or enforces session identity or access control, allowing unauthenticated callers to perform write operations on data they should not be able to modify. The CVSS vector (PR:N) confirms the attack requires no pre-existing credentials against the Oracle Net listener.

RemediationAI

Apply the patches distributed in Oracle's July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. The CPU advisory is the authoritative source for patched build numbers across the 19c, 21c, and 23ai release trains; no specific patched version number was independently confirmed in the available intelligence data, so administrators should consult the advisory directly to identify the correct target release for their environment. As a compensating control where immediate patching is not possible, restrict network access to Oracle Net listeners (default TCP 1521) via firewall rules or Oracle Connection Manager to limit exposure to trusted application-tier hosts only - this does not eliminate the vulnerability but substantially raises the barrier by reducing the attacker's ability to reach the JDBC layer. Additionally, review and enforce the principle of least privilege on JDBC-accessible schemas so that even if exploitation occurs, the scope of data that can be created, modified, or deleted is minimized. Monitor Oracle Net connection logs for unexpected source IPs or anomalous session patterns as a detective control.