Oracle Database Server EUVD-2026-105926

Exploitation requires (1) network reachability to the RDBMS over HTTP and (2) a low-privileged authenticated database account (CVSS PR:L), so this is not exploitable by fully unauthenticated attackers despite the network vector. Affected deployments are limited to Oracle Database Server RDBMS versions 23.4.0 through 23.26.3; earlier or patched releases are not in scope. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a low-privilege credential and HTTP access exist, exploitation is straightforward. The exact RDBMS feature or HTTP-facing service required is not disclosed in the Oracle advisory and should be confirmed with the vendor; the 'None privilege' phrasing in the description contradicts the PR:L vector and must be reconciled before scoping default-configuration exposure.

This is a moderate-priority confidentiality flaw (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The signals are internally consistent: network vector over HTTP, low attack complexity, no user interaction, and high confidentiality impact with zero integrity or availability impact. The single factor that meaningfully caps real-world risk is PR:L - the attacker must already hold at least a low-privileged authenticated account on the RDBMS, so this is not a pre-auth internet-facing compromise but rather a privilege-to-data-exfiltration escalation. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active or probable near-term exploitation; this reads as a high-CVSS-for-confidentiality but currently low-real-exploitation-pressure issue typical of a scheduled Oracle Critical Patch Update disclosure. Note one conflict to verify: the Oracle description text says 'low privileged attacker having None privilege,' which is self-contradictory, while the authoritative CVSS vector specifies PR:L - the vector (authenticated, low privilege) should be treated as the accurate requirement. The 'Authentication Bypass' tag also sits uneasily with a PR:L (authenticated) vector and should be confirmed against the vendor advisory.

An attacker who already holds a low-privileged database account sends crafted HTTP requests to the vulnerable RDBMS component of an affected Oracle Database Server (23.4.0-23.26.3) and abuses the flaw to read critical data they are not authorized to see, potentially gaining complete read access to all RDBMS-accessible data. Because AC:L and UI:N, exploitation is straightforward once network access and a low-privilege credential are obtained, though no public exploit code has been identified at the time of analysis.