What is the CVSS score of CVE-2026-60175?

CVE-2026-60175 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Database Server are affected by CVE-2026-60175?

A critical flaw in Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2) enables authenticated low-privileged users with network access to achieve full database compromise,…

How to fix or mitigate CVE-2026-60175?

Within 24 hours: Conduct a complete inventory of all Oracle Database instances running versions 19.x, 21.x, or 23.x across production and non-production environments; classify systems by business criticality and data sensitivity. Within 7 days: Contact Oracle Support to confirm patch availability timeline and interim mitigation options; immediately restrict Oracle Net protocol access via firewall to trusted administrative subnets only, and enforce multi-factor authentication for all database user accounts. Within 30 days: Implement sustained network access controls, database activity monitoring, and audit logging for all administrative operations; prioritize upgrade or replacement of systems where patch deployment is delayed beyond 60 days.

Oracle Database Server CVE-2026-60175

EUVD-2026-46581 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 oracle

GHSA-rg2p-xvg2-rf9w

Privilege Escalation Oracle Oracle Database Server Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable via Oracle Net with low complexity and no interaction, but a valid low-privilege account is required (PR:L); full RDBMS takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:08 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full database takeover in Oracle Database Server's RDBMS component allows an authenticated, low-privileged user with only network access via Oracle Net to fully compromise the database, per Oracle's July 2026 Critical Patch Update. The flaw affects versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, carrying a CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege bar make it a high-priority patch.

Technical ContextAI

The vulnerability resides in the core RDBMS engine of Oracle Database Server, reached over Oracle Net (the TNS-based client-server protocol on TCP 1521 by default). Because the affected component is the relational database kernel itself rather than an optional bolt-on, the attack surface is any SQL-capable session an authenticated account can open. Oracle did not assign a CWE (listed as N/A), and the CPU advisory does not disclose the root-cause weakness class, so the specific defect (e.g., privilege escalation via a built-in package, SQL injection in a system routine, or improper access control) cannot be pinned down from the available data. The CPE 'cpe:2.3:a:oracle_corporation:oracle_database_server' confirms the affected product is the database server software across the 19c, 21c, and 23ai release families.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update by upgrading to the corresponding patched Release Update above the affected ranges (19.31, 21.22, and 23.26.2 are the highest affected versions, so install the next RU/CPU patch level published for your family) as detailed at https://www.oracle.com/security-alerts/cpujul2026.html; exact fixed build numbers should be taken directly from that advisory rather than assumed. Because exploitation requires an authenticated database session, effective compensating controls until patching include tightly restricting who holds database accounts, revoking unnecessary privileges and PUBLIC grants, rotating and hardening application service-account credentials, and constraining Oracle Net (TCP 1521) reachability with valid-node checking or firewall ACLs so only trusted application hosts can connect - noting these controls reduce but do not eliminate risk from any legitimate low-privilege user and may disrupt clients if node lists are misconfigured. Enable database auditing on privileged and anomalous activity to detect exploitation attempts.