A vulnerability in the RDBMS component of Oracle Database Server enables an attacker who has no privileges to authenticate through an exposed HTTP interface and gain unauthorized read access to critical database information. The weakness results in a high confidentiality impact by exposing all data that the database service can provide.

Oracle Database Server versions 23.4.0 through 23.26.3 are affected. These releases run on systems where the database service is reachable via HTTP, either directly or through a proxy. Environments exposing the HTTP port without additional protection are vulnerable.

The CVSS v3.1 base score of 6.5 indicates moderate severity; the attack requires network connectivity to the HTTP endpoint and can be performed without privilege. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of public exploitation does not preclude adversaries from using it in future campaigns. Low privilege and easy network reachability make the risk significant in unsegmented networks.