EUVD-2026-47413
GHSA-fjrp-xwpc-qq2f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv account with Execute DBMS_CLOUD
-
DeliveryConnect over Oracle Net (TCP/1521)
-
ExploitAbuse DBMS_CLOUD to escalate privileges
-
ExecutionGain full RDBMS control
-
ImpactPivot via scope change to additional products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated database session with the Execute DBMS_CLOUD privilege (PR:L) and network reachability to the target over Oracle Net; it does not require user interaction or high/administrative privileges, and attack complexity is low. The concrete prerequisite named by Oracle is possession of the Execute DBMS_CLOUD privilege - environments where DBMS_CLOUD is not installed, or where that Execute privilege is not granted to lower-privileged users, are not exploitable via this path. The scope change (S:C) means a successful attack can impact products beyond the RDBMS itself. Limiting factors: the required DBMS_CLOUD grant, reachability of the Oracle Net listener (typically TCP/1521), and applicability only to Database 19.3-19.31 and 23.4.0-23.26.2. |
| Impact | The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable, low complexity, requires only low privileges, no user interaction, and a scope change with full CIA impact. The key limiting factor is PR:L - the attacker must already possess a valid database account with the Execute DBMS_CLOUD privilege, so this is not an anonymous internet-facing bug but a powerful privilege-escalation/takeover path for any user granted that privilege. No EPSS score was provided, the CVE is not in CISA KEV, and no POC or exploit code was referenced, so there is currently no evidence of active or widespread exploitation. Net assessment: a genuine high priority for any Oracle Database estate where DBMS_CLOUD is installed and its Execute privilege is granted to non-administrative users, but real-world exploitability is gated by that privilege grant. EPSS and CWE data are missing and should be checked once populated in NVD. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privileged Oracle account that carries the Execute DBMS_CLOUD privilege connects to the database over Oracle Net and invokes DBMS_CLOUD functionality in a crafted way to escalate to full RDBMS control. Because the vulnerability causes a scope change, the compromise can extend beyond the database to additional products, resulting in takeover. No public exploit code is currently identified, so an attacker would need to develop the technique or already possess the required privileged account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full takeover of the Oracle Database RDBMS component is possible for a low-privileged attacker who holds the Execute DBMS_CLOUD privilege and can reach the server over Oracle Net, affecting Database 19.3-19.31 and 23.4.0-23.26.2. Because the CVSS vector carries a scope change (S:C), a successful attack can pivot beyond the database to significantly impact additional products, yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the 9.9 base score is driven by low attack complexity and the scope change rather than by unauthenticated access.
RemediationAI
Apply the Oracle Critical Patch Update of July 2026, which contains the fix for this issue, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; apply the CPU-provided patch for your 19c or 23ai release - no independent per-release fixed version was included in the source data beyond the affected ranges 19.3-19.31 and 23.4.0-23.26.2). As a compensating control until patching, revoke the Execute privilege on the DBMS_CLOUD package from any non-administrative or application accounts that do not strictly require it (REVOKE EXECUTE ON DBMS_CLOUD), accepting that this will break legitimate cloud object-store integration for those users; and restrict network reachability of the Oracle Net listener (TCP/1521) using valid node checking or a firewall so only trusted hosts can connect, which reduces the population of accounts able to reach the vector but does not fix the underlying flaw. Audit existing grants of Execute DBMS_CLOUD to identify who currently has the prerequisite privilege.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the core RDBMS engine of Oracle Database and is reachable through the DBMS_CLOUD PL/SQL package, an Oracle-supplied package used to interact with cloud object stores and external endpoints (originally from Autonomous Database, now available on-premises via the DBMS_CLOUD install). Exploitation requires the Execute DBMS_CLOUD privilege, indicating the attack abuses functionality exposed by this package to escalate from a granted database privilege to full RDBMS control. Oracle did not assign a CWE (CWE: N/A), but the pattern - a privileged package that performs actions on behalf of a lower-privileged caller leading to privilege escalation and scope change - is consistent with an authorization/privilege-management or SSRF-style trust-boundary weakness. Access is over Oracle Net (TNS, typically TCP/1521), the standard client-server protocol for Oracle databases.
Know when Database Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable via Oracle Net (AV:N/AC:L), requires the granted Execute DBMS_CLOUD privilege so PR:L not PR:N, no user interaction, and a scope change with full CIA takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Execute DBMS_CLOUD privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Database versions 19.3-19.31 and 23.4.0-23.26.2 are vulnerable to complete database takeover by attackers with DBMS_CLOUD privilege and Oracle Net access, with potential lateral movement to other systems. This critical vulnerability poses an immediate threat to data confidentiality, integrity, and availability across affected enterprise deployments.
No vendor-released patch identified at time of analysis. Implement privilege-based mitigations: revoke DBMS_CLOUD privilege from all non-essential accounts, restrict Oracle Net listener access to trusted internal networks only via firewall, enable database audit logging for all DBMS_CLOUD operations, and deploy real-time monitoring for privilege escalation attempts. These are interim measures only; patching remains the required long-term remediation upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Database Server
View allThe TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.
The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 all
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv
An exploitable out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Datab
An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospik
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointe
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via v
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point
Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.
An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database
Exploit-DB