Oracle Database Server EUVD-2026-106807

Exploitation requires a low-privileged authenticated account on the Oracle Database Server (PR:L) and network reachability to the Java VM component specifically via the SOCKS5 protocol pathway. The Java VM (Oracle JVM / OJVM) option must be installed and in use within the database for the component to be exposed. Limiting factors are significant: Oracle explicitly rates this 'Difficult to exploit' (AC:H), no user interaction is needed (UI:N), and impact is confined to data integrity (I:H) with no confidentiality or availability loss. The scope change (S:C) is the amplifying factor - a successful attack can impact additional products beyond the Java VM. Affected versions are 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3.

This is a moderate-priority issue, not a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N, base 6.3) describes a network-reachable but hard-to-exploit flaw: AC:H reflects Oracle's own 'Difficult to exploit' language, PR:L means the attacker must already hold a low-privileged database account, and impact is integrity-only (I:H) with no confidentiality or availability loss. The scope change (S:C) is the one factor that elevates concern - a successful attack can reach products beyond the Java VM itself. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Note a wording conflict: the description says 'low privileged attacker having None privilege,' which is ambiguous, but the authoritative CVSS vector specifies PR:L, so exploitation is treated as requiring authentication. Overall, the combination of high attack complexity, an authentication prerequisite, and integrity-only impact keeps real-world risk well below the alarm implied by Oracle DB's ubiquity; prioritize patching in the normal quarterly cycle, prioritizing internet-exposed or multi-tenant database instances given the scope change.

An attacker who already holds a low-privileged account on an affected Oracle Database instance reaches the Java VM component over the network via a SOCKS5 pathway and, after overcoming significant exploitation difficulty, manipulates data integrity. Because the flaw causes a scope change, the resulting unauthorized creation, deletion, or modification can extend to critical data in additional products beyond the Java VM. No public exploit code is identified at time of analysis, and the high complexity makes opportunistic mass exploitation unlikely.