What is the CVSS score of CVE-2026-47061?

CVE-2026-47061 has a CVSS 3.1 base score of 5.6 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle Database Server CVE-2026-47061

EUVD-2026-46547 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-c5hf-jh6v-96wh

Authentication Bypass Oracle Oracle Database Server Oracle Corporation

5.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.6 MEDIUM

AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

vuln.today AI

5.6 MEDIUM

Adjacent vector reflects physical segment requirement; PR:N confirmed by unauthenticated description; UI:R and AC:H limit exploitation; S:C and C:H reflect scope-crossing data disclosure with no integrity or availability impact.

3.1 AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:33 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 5.6

DescriptionCVE.org

Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JDBC executes to compromise JDBC. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JDBC, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JDBC accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N).

AnalysisAI

Confidentiality breach in the JDBC component of Oracle Database Server allows an unauthenticated attacker positioned on the same physical communication segment to bypass authentication and gain complete read access to JDBC-accessible data, including critical database contents. Affected deployments span three major release lines: 19c (19.3-19.31), 21c (21.3-21.22), and 23ai (23.4.0-23.26.2). Exploitation requires both network adjacency and human interaction from a legitimate user, and a successful attack can extend its impact beyond JDBC itself to additional connected products due to a scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The Java Database Connectivity (JDBC) component in Oracle Database Server implements the standard Java API for relational database access, handling connection negotiation, authentication credential exchange, and query transport between client applications and the Oracle RDBMS engine. The affected CPE (cpe:2.3:a:oracle_corporation:oracle_database_server) spans the 19c Long-Term Support, 21c Innovation, and 23ai Long-Term Support release families. The attack surface is the physical or layer-2 communication segment carrying JDBC traffic, meaning the vulnerability likely involves the JDBC wire protocol - for example, an on-path attacker manipulating connection handshakes or credential exchange. The tag 'Authentication Bypass' indicates the weakness allows an unauthenticated party to circumvent the JDBC authentication mechanism. CWE is not specified in available data, limiting precise root-cause classification, but the authentication bypass pattern and scope-change behavior are consistent with weaknesses such as improper credential validation or insecure protocol negotiation on the wire.

RemediationAI

The primary remediation is to apply the patches distributed in Oracle's July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish individual patch version numbers in the advisory text provided; administrators should consult the full CPU document and My Oracle Support for the exact patchset identifiers for their respective 19c, 21c, or 23ai installations. An exact patched release version is not independently confirmed from available data - treat any version numbers beyond the advisory as unverified until cross-referenced with My Oracle Support. As a compensating control where immediate patching is not feasible, network segmentation of JDBC communication paths is the most actionable mitigation: restrict layer-2 and layer-3 adjacency to the database host's JDBC port (default TCP 1521) to only authorized client subnets using firewall ACLs or VLAN isolation, which directly addresses the AV:A attack vector and removes the attacker's ability to reach the communication segment. Additionally, Oracle Advanced Security TLS encryption for JDBC connections should be enforced, as strong mutual TLS on the wire would harden the authentication exchange against on-path manipulation. Disabling unused JDBC listener endpoints on multi-homed hosts reduces the attack surface further. Each of these controls narrows exposure but does not eliminate the underlying vulnerability - patching remains the definitive fix.