Oracle Database Server
Monthly
Full database takeover in Oracle Database Server's RDBMS component allows an authenticated, low-privileged user with only network access via Oracle Net to fully compromise the database, per Oracle's July 2026 Critical Patch Update. The flaw affects versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, carrying a CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege bar make it a high-priority patch.
Confidentiality breach in the JDBC component of Oracle Database Server allows an unauthenticated attacker positioned on the same physical communication segment to bypass authentication and gain complete read access to JDBC-accessible data, including critical database contents. Affected deployments span three major release lines: 19c (19.3-19.31), 21c (21.3-21.22), and 23ai (23.4.0-23.26.2). Exploitation requires both network adjacency and human interaction from a legitimate user, and a successful attack can extend its impact beyond JDBC itself to additional connected products due to a scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, delete, or modify critical data or all JDBC-accessible data via Oracle Net. Affected releases span three supported branches: 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Exploitation requires human interaction from a party other than the attacker, limiting opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticated remote attacker reach the database over Oracle Net and trigger a hang or repeatable crash, and additionally gain unauthorized update, insert, or delete access to some database-accessible data. Rated CVSS 3.1 8.2 (High) with network attack vector and low complexity, it requires no privileges or user interaction, making it easily exploitable per Oracle's advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operating via Oracle Net, contingent on inducing human interaction from a separate party. All three actively maintained Oracle Database release tracks - 19c, 21c, and 23ai - are confirmed affected across their respective patch set ranges. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete confidentiality, integrity, and availability compromise of the JDBC layer.
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding only the Create Session privilege to arbitrarily create, delete, or modify critical data or all Java VM-accessible data within the database. All three actively supported release lines are affected - 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2 - as confirmed in Oracle's July 2026 Critical Patch Update. Oracle explicitly characterizes this as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected attacker to perform insert, update, or delete operations against a subset of data accessible within the database. Affected versions span the 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2 release trains, all reachable over Oracle Net without user interaction. No public exploit has been identified at time of analysis; with a CVSS 3.1 score of 2.7 and integrity-only impact, the risk is primarily relevant to environments where high-privileged database credentials may be compromised or misused.
Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-accessible attackers to perform unauthorized data manipulation - INSERT, UPDATE, or DELETE - against RDBMS-accessible data via Oracle Net. The CVSS vector (S:C) confirms a scope change, meaning successful exploitation may cascade to additional products or components beyond the targeted database instance. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the zero-barrier network entry (PR:N, AC:L, UI:N) across three actively supported Oracle release families represents a meaningful priority for internet-exposed or multi-tenant Oracle Database environments.
Remote denial of service in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated network attackers to crash or hang the Net Service component via crafted TLS traffic. The flaw scores CVSS 7.5 with availability-only impact and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote denial-of-service in Oracle Database Server's Net Service component (versions 23.4.0 through 23.26.2) allows unauthenticated attackers with TLS network access to hang or repeatedly crash the listener, producing a complete DoS of database connectivity. The flaw is rated CVSS 7.5 (availability-only) and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Net Service takeover in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated remote attackers reaching the TLS-protected Net Service listener to fully compromise confidentiality, integrity, and availability, with scope change indicating impact on adjacent components. CVSS 9.0 reflects high impact tempered by high attack complexity (AC:H), and no public exploit identified at time of analysis. Reported and tracked in Oracle's May 2026 Critical Patch Update advisory.
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to compromise the Java VM over Oracle Net (default port 1521) and read all data accessible to it, affecting versions 19.3-19.30 and 21.3-21.21. The flaw is rated CVSS 7.5 with confidentiality-only impact and is easily exploitable per Oracle, though EPSS is very low (0.03%, 9th percentile) and no public exploit identified at time of analysis. It is addressed in the Oracle Critical Patch Update of April 2026.
Unauthorized read access in Oracle Database Server's RDBMS component (versions 19.3-19.30) is achievable by a highly privileged attacker holding the Row Access Method privilege, via multiple network protocols, when a third party performs required human interaction. Impact is limited to a partial confidentiality disclosure of RDBMS-accessible data with no integrity or availability effects. No public exploit exists and EPSS at 0.03% (7th percentile) reflects near-zero exploitation likelihood; SSVC confirms exploitation status as none and the attack is not automatable.
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via network-accessible HTTPS endpoints in versions 23.4.0 through 23.26.1. An unauthenticated remote attacker exploiting this CWE-200 information exposure flaw - tagged as involving authentication bypass - can obtain complete access to all XML Database accessible data, but success requires high attack complexity and human interaction from a victim user. No active exploitation is confirmed (EPSS 0.03%, 9th percentile; CISA KEV absent; SSVC exploitation: none), placing this firmly in the patch-on-schedule category despite the high confidentiality impact stated in the CVSS.
Full database takeover in Oracle Database Server's RDBMS component allows an authenticated, low-privileged user with only network access via Oracle Net to fully compromise the database, per Oracle's July 2026 Critical Patch Update. The flaw affects versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, carrying a CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege bar make it a high-priority patch.
Confidentiality breach in the JDBC component of Oracle Database Server allows an unauthenticated attacker positioned on the same physical communication segment to bypass authentication and gain complete read access to JDBC-accessible data, including critical database contents. Affected deployments span three major release lines: 19c (19.3-19.31), 21c (21.3-21.22), and 23ai (23.4.0-23.26.2). Exploitation requires both network adjacency and human interaction from a legitimate user, and a successful attack can extend its impact beyond JDBC itself to additional connected products due to a scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, delete, or modify critical data or all JDBC-accessible data via Oracle Net. Affected releases span three supported branches: 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Exploitation requires human interaction from a party other than the attacker, limiting opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticated remote attacker reach the database over Oracle Net and trigger a hang or repeatable crash, and additionally gain unauthorized update, insert, or delete access to some database-accessible data. Rated CVSS 3.1 8.2 (High) with network attack vector and low complexity, it requires no privileges or user interaction, making it easily exploitable per Oracle's advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operating via Oracle Net, contingent on inducing human interaction from a separate party. All three actively maintained Oracle Database release tracks - 19c, 21c, and 23ai - are confirmed affected across their respective patch set ranges. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete confidentiality, integrity, and availability compromise of the JDBC layer.
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding only the Create Session privilege to arbitrarily create, delete, or modify critical data or all Java VM-accessible data within the database. All three actively supported release lines are affected - 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2 - as confirmed in Oracle's July 2026 Critical Patch Update. Oracle explicitly characterizes this as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected attacker to perform insert, update, or delete operations against a subset of data accessible within the database. Affected versions span the 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2 release trains, all reachable over Oracle Net without user interaction. No public exploit has been identified at time of analysis; with a CVSS 3.1 score of 2.7 and integrity-only impact, the risk is primarily relevant to environments where high-privileged database credentials may be compromised or misused.
Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-accessible attackers to perform unauthorized data manipulation - INSERT, UPDATE, or DELETE - against RDBMS-accessible data via Oracle Net. The CVSS vector (S:C) confirms a scope change, meaning successful exploitation may cascade to additional products or components beyond the targeted database instance. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the zero-barrier network entry (PR:N, AC:L, UI:N) across three actively supported Oracle release families represents a meaningful priority for internet-exposed or multi-tenant Oracle Database environments.
Remote denial of service in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated network attackers to crash or hang the Net Service component via crafted TLS traffic. The flaw scores CVSS 7.5 with availability-only impact and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote denial-of-service in Oracle Database Server's Net Service component (versions 23.4.0 through 23.26.2) allows unauthenticated attackers with TLS network access to hang or repeatedly crash the listener, producing a complete DoS of database connectivity. The flaw is rated CVSS 7.5 (availability-only) and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Net Service takeover in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated remote attackers reaching the TLS-protected Net Service listener to fully compromise confidentiality, integrity, and availability, with scope change indicating impact on adjacent components. CVSS 9.0 reflects high impact tempered by high attack complexity (AC:H), and no public exploit identified at time of analysis. Reported and tracked in Oracle's May 2026 Critical Patch Update advisory.
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to compromise the Java VM over Oracle Net (default port 1521) and read all data accessible to it, affecting versions 19.3-19.30 and 21.3-21.21. The flaw is rated CVSS 7.5 with confidentiality-only impact and is easily exploitable per Oracle, though EPSS is very low (0.03%, 9th percentile) and no public exploit identified at time of analysis. It is addressed in the Oracle Critical Patch Update of April 2026.
Unauthorized read access in Oracle Database Server's RDBMS component (versions 19.3-19.30) is achievable by a highly privileged attacker holding the Row Access Method privilege, via multiple network protocols, when a third party performs required human interaction. Impact is limited to a partial confidentiality disclosure of RDBMS-accessible data with no integrity or availability effects. No public exploit exists and EPSS at 0.03% (7th percentile) reflects near-zero exploitation likelihood; SSVC confirms exploitation status as none and the attack is not automatable.
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via network-accessible HTTPS endpoints in versions 23.4.0 through 23.26.1. An unauthenticated remote attacker exploiting this CWE-200 information exposure flaw - tagged as involving authentication bypass - can obtain complete access to all XML Database accessible data, but success requires high attack complexity and human interaction from a victim user. No active exploitation is confirmed (EPSS 0.03%, 9th percentile; CISA KEV absent; SSVC exploitation: none), placing this firmly in the patch-on-schedule category despite the high confidentiality impact stated in the CVSS.