Oracle Database Server EUVD-2026-46531

Exploitation requires the attacker to hold high-privileged Oracle Database credentials (PR:H per the CVSS vector) - this is explicitly not an unauthenticated attack path. The attacker must also reach the Oracle Net listener over the network (AV:N), meaning the database's TNS/SQL*Net port must be accessible from the attacker's position. A critical additional prerequisite is human interaction from a person other than the attacker (UI:R per CVSS), introducing a mandatory social engineering or session-manipulation step - the vulnerability cannot be triggered purely by the attacker acting alone. Limiting factors that constrain realistic risk: (1) requirement for pre-existing high-privilege database access significantly limits the exploitable attacker population; (2) the mandatory third-party human interaction step means automated, unaided exploitation is not viable; (3) scope does not change (S:U), so impact is bounded to the JDBC component rather than enabling host OS escape or lateral movement to other systems. Non-default configurations or specific JDBC features required to trigger the flaw are not described in available data.

The CVSS 3.1 score of 6.8 (Medium) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H reflects a significant tension between impact and exploitability preconditions. The attack vector is network (AV:N) with low complexity (AC:L), but two hard constraints cap practical risk: the attacker must already possess high-privileged Oracle database credentials (PR:H), and must engineer human interaction from a third party (UI:R). These requirements substantially narrow the exploitable population - opportunistic automated attacks are not viable, and exploitation is more consistent with insider threat, credential compromise followed by social engineering, or targeted attack scenarios. Scope is unchanged (S:U), confining blast radius to the JDBC component itself rather than enabling host-level escape. EPSS data was not provided, preventing quantitative exploitation-probability assessment. No CISA KEV listing and no public POC have been identified, supporting a conclusion of no widespread active exploitation at time of analysis. The 6.8 score is reasonable given constraints, though security teams managing environments where privileged Oracle accounts may be shared, exposed to untrusted insiders, or subject to credential theft should treat this with elevated urgency relative to the numeric score alone.

An attacker who has obtained high-privileged Oracle Database credentials - through phishing, credential dump, or insider access - connects to the target database over Oracle Net targeting the JDBC component. The attacker then induces a legitimate user (such as a DBA or application owner) to perform an action that triggers the vulnerable JDBC code path, for example by sending a crafted request that requires the victim's session context to complete processing. Upon successful triggering, the attacker achieves full takeover of the JDBC component, enabling data exfiltration, data manipulation, or disruption of database connectivity for dependent applications.