EUVD-2026-46531
GHSA-qv2m-wjh4-mv79
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Vendor-provided vector is consistent with description: high privilege required (PR:H), mandatory user interaction (UI:R), network delivery via Oracle Net (AV:N), full triad impact on JDBC, no scope change (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows high privileged attacker having None privilege with network access via Oracle Net to compromise JDBC. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JDBC. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operating via Oracle Net, contingent on inducing human interaction from a separate party. All three actively maintained Oracle Database release tracks - 19c, 21c, and 23ai - are confirmed affected across their respective patch set ranges. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete confidentiality, integrity, and availability compromise of the JDBC layer.
Technical ContextAI
Oracle Database Server's JDBC (Java Database Connectivity) component provides the Java API layer for client-to-database communication, operating over Oracle Net - Oracle's proprietary network protocol stack that underlies SQL*Net/TNS. The vulnerability resides within this JDBC component as exposed via Oracle Net, meaning the attack surface is the database's network listener rather than a web or application tier. The CPE string cpe:2.3:a:oracle_corporation:oracle_database_server confirms this is Oracle Corporation's core relational database engine, covering the 19c, 21c, and 23ai (formerly 23c) release families. No CWE has been assigned by Oracle or NVD, which limits root-cause classification - the specific coding defect class (e.g., deserialization, injection, logic flaw within the JDBC protocol handler) cannot be confirmed from available data. The tags suggest an information disclosure angle, but the CVSS impact metrics (C:H/I:H/A:H) indicate full triad compromise, which may reflect secondary effects of JDBC takeover rather than a simple read-only disclosure.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU mechanism delivers fixes as patch sets targeting versions above the affected ceiling within each release track (19c, 21c, 23ai); consult the CPU documentation to identify the specific patched patch set level for your installed release, as exact fixed version numbers beyond the CPU advisory are not independently confirmed in the available data. As a compensating control while patching is scheduled, restrict Oracle Net listener access to the JDBC endpoint via network ACLs or Oracle Connection Manager (CMAN) so that only explicitly authorized, trusted client hosts can reach the database listener - this reduces the network attack surface but does not eliminate the vulnerability and may disrupt legitimate application connectivity if not scoped carefully. Additionally, audit and reduce the number of accounts holding high-privileged database roles, as PR:H is a hard prerequisite for exploitation.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today