Oracle Database Server EUVD-2026-46468

No special conditions are required beyond network connectivity to the Oracle Net listener: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated, low-complexity, no-interaction remote exploitability against default Oracle Database deployments on affected versions. The primary limiting factor is network access - deployments where Oracle Net (TCP/1521 or configured alternative port) is not accessible from untrusted networks are substantially protected; environments where the listener is internet-exposed or reachable from a broad internal network segment are most at risk. Exploitation is constrained to versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2 - fully patched instances within these families or deployments on other versions are not confirmed affected. Impact is bounded to integrity (no confidentiality or availability compromise), limiting the attacker to data manipulation rather than exfiltration or denial of service.

The CVSS 3.1 base score of 5.8 reflects a medium-severity rating driven by a scope change (S:C) offset by limited integrity-only impact (I:L) and no confidentiality or availability impact. The attack vector combination - AV:N/AC:L/PR:N/UI:N - describes the lowest possible exploitation barrier: any network-reachable, unauthenticated party can attempt exploitation without special conditions. No EPSS score is available in the provided data, so probabilistic exploitation frequency cannot be quantified. The absence of a CISA KEV listing and any POC reference suggests this is not currently under broad active exploitation, placing this closer to a patch-cycle priority than an emergency response. That said, Oracle Database Server's widespread enterprise footprint combined with trivial exploitation prerequisites means that if a reliable POC surfaces, mass exploitation would be feasible rapidly. The integrity-only impact - no data theft, no service disruption - somewhat reduces urgency for read-heavy workloads, but INSERT/UPDATE/DELETE access against financial, healthcare, or configuration data carries significant downstream risk. The scope change amplifies impact for environments where the RDBMS feeds downstream systems.

An unauthenticated attacker with TCP connectivity to an exposed Oracle Net listener (port 1521) sends crafted Oracle Net protocol messages that bypass the RDBMS authentication layer without valid credentials. Upon successful bypass, the attacker issues unauthorized DML statements - INSERT, UPDATE, or DELETE - targeting RDBMS-accessible tables, potentially corrupting application records or manipulating audit trails. Due to the scope change, dependent application tiers or linked Oracle services consuming the tampered data may themselves be adversely affected, amplifying business impact beyond the database layer. No public POC has been identified at time of analysis.