EUVD-2026-47413
GHSA-fjrp-xwpc-qq2f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable via Oracle Net (AV:N/AC:L), requires the granted Execute DBMS_CLOUD privilege so PR:L not PR:N, no user interaction, and a scope change with full CIA takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Execute DBMS_CLOUD privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Full takeover of the Oracle Database RDBMS component is possible for a low-privileged attacker who holds the Execute DBMS_CLOUD privilege and can reach the server over Oracle Net, affecting Database 19.3-19.31 and 23.4.0-23.26.2. Because the CVSS vector carries a scope change (S:C), a successful attack can pivot beyond the database to significantly impact additional products, yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the 9.9 base score is driven by low attack complexity and the scope change rather than by unauthenticated access.
Technical ContextAI
The flaw resides in the core RDBMS engine of Oracle Database and is reachable through the DBMS_CLOUD PL/SQL package, an Oracle-supplied package used to interact with cloud object stores and external endpoints (originally from Autonomous Database, now available on-premises via the DBMS_CLOUD install). Exploitation requires the Execute DBMS_CLOUD privilege, indicating the attack abuses functionality exposed by this package to escalate from a granted database privilege to full RDBMS control. Oracle did not assign a CWE (CWE: N/A), but the pattern - a privileged package that performs actions on behalf of a lower-privileged caller leading to privilege escalation and scope change - is consistent with an authorization/privilege-management or SSRF-style trust-boundary weakness. Access is over Oracle Net (TNS, typically TCP/1521), the standard client-server protocol for Oracle databases.
RemediationAI
Apply the Oracle Critical Patch Update of July 2026, which contains the fix for this issue, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; apply the CPU-provided patch for your 19c or 23ai release - no independent per-release fixed version was included in the source data beyond the affected ranges 19.3-19.31 and 23.4.0-23.26.2). As a compensating control until patching, revoke the Execute privilege on the DBMS_CLOUD package from any non-administrative or application accounts that do not strictly require it (REVOKE EXECUTE ON DBMS_CLOUD), accepting that this will break legitimate cloud object-store integration for those users; and restrict network reachability of the Oracle Net listener (TCP/1521) using valid node checking or a firewall so only trusted hosts can connect, which reduces the population of accounts able to reach the vector but does not fix the underlying flaw. Audit existing grants of Execute DBMS_CLOUD to identify who currently has the prerequisite privilege.
More in Database Server
View allThe TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.
The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 all
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv
An exploitable out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Datab
An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospik
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via v
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointe
Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.
An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database
An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today