Description
Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JDBC. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JDBC accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Easily exploitable vulnerability in the JDBC component of Oracle Database Server allows an attacker with network access via Oracle Net to compromise the component and gain the ability to create, delete or modify critical data. This results in an integrity impact as the attacker can alter database contents without authentication, affecting critical or all JDBC accessible data.

Affected Systems

Oracle Database Server, JDBC component, versions 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2.

Risk and Exploitability

The CVSS v3.1 base score of 6.5 indicates a moderate severity with high integrity impact. The EPSS score of < 1% suggests a very low probability of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Attacks would require unauthenticated network access to Oracle Net, and it is inferred that the attacker may need to convince a human user to interact with malicious JDBC payloads, implying an attacker effort.

Generated by OpenCVE AI on August 5, 2026 at 02:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor patch for Oracle Database Server that addresses JDBC component vulnerabilities
  • Restrict Oracle Net traffic to trusted IP ranges and enforce strong authentication mechanisms
  • Disable or restrict unused JDBC services and implement role-based access control for all database operations

Generated by OpenCVE AI on August 5, 2026 at 02:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated JDBC Component Vulnerability Allows Unauthorized Data Modification

Tue, 28 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Untrusted JDBC Vulnerability Enabling Unauthorized Data Modification in Oracle Database Server
Weaknesses CWE-285

Fri, 24 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title Untrusted JDBC Vulnerability Enabling Unauthorized Data Modification in Oracle Database Server
Weaknesses CWE-285

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle database Server
Vendors & Products Oracle database Server

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JDBC. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JDBC accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).
First Time appeared Oracle
Oracle database - Jdbc
CPEs cpe:2.3:a:oracle:database_-_jdbc:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle database - Jdbc
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

Subscriptions

Oracle Database - Jdbc Database Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T17:06:32.773Z

Reserved: 2026-05-18T15:55:10.319Z

Link: CVE-2026-47060

cve-icon Vulnrichment

Updated: 2026-07-23T16:13:34.551Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:17:11.850

Modified: 2026-08-06T13:42:09.097

Link: CVE-2026-47060

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T02:15:03Z

Weaknesses