Oracle Database Server CVE-2026-47060

Exploitation requires network access to the target Oracle Database Server's Oracle Net listener (typically TCP 1521) from an unauthenticated position - no database credentials are needed, consistent with PR:N in the CVSS vector. The critical limiting condition is the mandatory human interaction requirement (UI:R): a person other than the attacker must perform some action to complete the attack, meaning fully automated, zero-interaction exploitation is not possible against this vulnerability. This human interaction requirement is not further specified in the available description, so the exact user action needed is unconfirmed. Exploitation is constrained to Oracle Database Server versions within the three listed ranges (19.3-19.31, 21.3-21.22, 23.4.0-23.26.2); patched or out-of-range versions are not identified as affected. There is no indication that a non-default configuration is required - the JDBC component is a core feature present in standard Oracle Database deployments.

The vendor-assigned CVSS 3.1 base score of 6.5 reflects a network-reachable (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) but mandating active user interaction (UI:R), with unchanged scope and exclusively integrity impact (I:H). The UI:R constraint is the primary risk-reduction factor: an attacker must socially engineer or otherwise induce a legitimate user into performing an action, preventing fully automated exploitation and reducing weaponization potential compared to a UI:N flaw. Impact is limited to data integrity - confidentiality (C:N) and availability (A:N) are unaffected, ruling out credential theft or denial-of-service scenarios from this vector alone. No EPSS score was provided in the source data, so exploitation probability cannot be quantitatively compared. There is no KEV listing and no identified public proof-of-concept, suggesting opportunistic mass exploitation is not currently occurring. Despite a moderate CVSS score, the 'Authentication Bypass' tag warrants elevated attention in environments where JDBC endpoints are network-exposed, as successful exploitation could corrupt or delete business-critical data without leaving authenticated session artifacts.

An unauthenticated remote attacker with network access to the Oracle Net listener sends a crafted Oracle Net request targeting the JDBC component, then manipulates a legitimate database user into triggering an interaction - such as opening a link, executing a query, or processing a crafted response - that completes the authentication bypass. Once the bypass succeeds, the attacker gains the ability to issue write operations against JDBC-accessible data, potentially corrupting, deleting, or inserting records in critical application tables. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests that once the social engineering prerequisite is overcome, the technical exploitation step does not require specialized skill.