Oracle Database Server EUVD-2026-46581

Exploitation requires the attacker to hold a valid authenticated database account with at least low (any) privileges (CVSS PR:L) and network reachability to the database over Oracle Net (typically TCP 1521), with no user interaction needed (UI:N) and low attack complexity (AC:L). The limiting factor is that fully unauthenticated/anonymous attackers cannot exploit this directly - a working credential or hijacked session is a prerequisite - and the target must be a running instance in one of the affected version ranges (19.3-19.31, 21.3-21.22, 23.4.0-23.26.2) reachable via the listener; no non-default feature toggle is called out in the advisory, so default configurations of these versions appear exploitable once a low-privileged session is established.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) is internally consistent and describes a genuinely dangerous, easily exploitable flaw: network-reachable, low complexity, no user interaction, and only a single low-privileged authenticated account needed, yielding complete C/I/A compromise ('takeover of RDBMS'). The one meaningful barrier is PR:L - the attacker must already hold a valid, low-privilege database account, which excludes fully anonymous internet attackers but is well within reach of any insider, compromised application service account, or attacker who has phished/reused credentials. No EPSS score, KEV listing, or POC is present in the provided data, so probability-of-exploitation signals are absent rather than low; this is a high-CVSS issue whose real-world exploitation likelihood is currently unquantified. Given that any valid DB user can achieve full takeover, this should be treated as a real priority in Oracle CPU remediation, not a paper-high score.

An attacker who has obtained any low-privilege Oracle account - via a leaked application connection string, credential reuse, or a malicious insider - connects to the listener over Oracle Net and issues the crafted operation against the vulnerable RDBMS component to escalate to full database control. Because the attack is low-complexity and requires no user interaction, a single valid login is enough to move from ordinary user to complete takeover of the database. No public exploit code has been identified at time of analysis.