CVE-2026-35229

Published Apr 21, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.30 and 21.3-21.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java VM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Analysis

Technical impact

The vulnerability lies in the Java VM component of Oracle Database Server. An attacker who can reach the server over Oracle Net, without authentication, can exploit the weakness to compromise the Java VM. Successful attacks can provide unauthorized access to critical data stored in the database or to any data that the Java VM can retrieve, resulting in a significant breach of confidentiality.

Affected Systems

Oracle Corporation’s Oracle Database Server is affected. Versions 19c from 19.3 through 19.30 and 21c from 21.3 through 21.21 contain the vulnerable Java VM component.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 highlights a high confidentiality impact. The attack vector is network-based via Oracle Net, requires no authentication, and an attacker can launch the exploit with low effort. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog, but public documentation indicates that it can be exploited. Organizations should treat it as a significant risk until a patch is applied.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Database Server

affected

Version	Status	Constraints
`19.3`	affected	≤ 19.30
`21.3`	affected	≤ 21.21

Configuration 1 [-]

OR	cpe:2.3:a:oracle:java_virtual_machine::::::::
	cpe:2.3:a:oracle:java_virtual_machine::::::::

No data.

Vendor Product Versions

Oracle

Database - Java Vm

Version	Status	Scheme	Platform
`—`	affected	—	—

Oracle

Database Server

Version	Status	Scheme	Platform
`[19.3,19.30]`	affected	generic	—
`[21.3,21.21]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any available Oracle patches for the Java VM component in versions 19.3‑19.30 and 21.3‑21.21 as soon as they are released.
Restrict Oracle Net access to trusted hosts only using firewall or ACL rules to reduce unauthenticated network reach.
If the Java VM functionality is not required, disable or remove it from the database instance to eliminate the attack surface.
Continuously monitor database and network logs for anomalous Oracle Net connections or unexpected Java VM activity and investigate promptly.

Generated by OpenCVE AI on April 27, 2026 at 19:29 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.314% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cpuapr2026.html

History

May 5, 2026 4:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Oracle java Virtual Machine
CPEs		cpe:2.3:a:oracle:java_virtual_machine::::::::
Vendors & Products		Oracle java Virtual Machine

Apr 27, 2026 7:45 PM Title updated View changes

Type	Values Removed	Values Added
Title	Java VM Component Vulnerability Allows Unauthenticated Access to Database Data via Oracle Net

Apr 22, 2026 4:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 22, 2026 7:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Oracle database Server
Vendors & Products		Oracle database Server

Apr 22, 2026 5:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Java VM Component Vulnerability Allows Unauthenticated Access to Database Data via Oracle Net

Apr 22, 2026 12:00 AM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.30 and 21.3-21.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java VM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared		Oracle Oracle database - Java Vm
CPEs		cpe:2.3:a:oracle:database_-_java_vm::::::::
Vendors & Products		Oracle Oracle database - Java Vm
References		https://www.oracle.com/security-alerts/cpuapr2026.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`