Oracle Database Server CVE-2026-47061

Exploitation requires the attacker to have network adjacency - specifically, access to the physical or logical communication segment (such as an Ethernet broadcast domain, VLAN, or layer-2 segment) through which JDBC traffic between the Oracle Database Server and its clients flows. This rules out remote internet-based attackers entirely. Additionally, AC:H indicates one or more specific conditions beyond attacker control must be satisfied, such as a particular protocol state or timing window. Human interaction from a legitimate user (UI:R) is mandatory - an Oracle JDBC client must independently initiate a connection during the attack window; the attacker cannot trigger this themselves. The CVSS PR:N vector confirms no prior authentication or account credentials are needed by the attacker. Exploitation is not possible from outside the adjacent segment, and the attacker cannot force the required user interaction, meaning opportunistic or automated scanning-based exploitation is not feasible. The scope change (S:C) means environments where multiple products share a common JDBC communication path face broader potential confidentiality exposure than the CVSS base score alone suggests.

The Oracle-assigned CVSS 3.1 score of 5.6 (Medium) accurately captures the constrained exploitation conditions. The AV:A (Adjacent) vector is the most significant risk-reduction factor: the attacker must be co-located on the same physical or logical network segment as the database JDBC traffic, ruling out opportunistic internet-scale exploitation. AC:H (High Complexity) further limits practical exploitation, implying specialized conditions such as precise timing, specific protocol state, or environmental prerequisites beyond attacker control. UI:R requires a legitimate user to interact - likely initiating a JDBC connection - which cannot be forced by the attacker alone. Despite these constraints, C:H with S:C (Scope Change) is a serious outcome: a successful attack yields complete read access to all JDBC-accessible data, potentially crossing security boundaries into additional products. No EPSS data is available in the provided intelligence; no CISA KEV listing exists; no POC code has been identified. The net real-world risk tier is moderate-to-low for most organizations: this is not a remotely exploitable, low-complexity flaw, but environments with insufficiently segmented internal networks or shared JDBC infrastructure across sensitive systems should treat the scope-change vector as a meaningful escalation risk. CVSS signals and description are consistent - no conflicts detected.

An attacker with a foothold on the same internal network segment - such as a compromised workstation in the same VLAN as a database server, or a rogue device on a data center switch - monitors JDBC connection attempts from legitimate client applications. When a database user or application initiates a JDBC session (the required human interaction), the attacker performs an on-path interception or protocol manipulation that exploits the authentication bypass, gaining the ability to read all data accessible through that JDBC connection, including data from additional systems sharing the same database infrastructure. No public proof-of-concept code has been identified, and the AC:H rating indicates that successfully executing this attack requires non-trivial technical capability beyond script-kiddie level.