This vulnerability enables a high‑privileged attacker who already holds Oracle Database Server Query Optimizer privilege to read a subset of data that the database can access. The weakness resides in the RDBMS component and impacts confidentiality without affecting integrity or availability. Successful exploitation requires network access through Oracle Net and results in unauthorized disclosure of sensitive information.

Affected versions are Oracle Database Server 19.3 through 19.32 and 21.3 through 21.23. These releases are listed as supported products in the CNA entry and include the RDBMS component; no additional sub‑version filtering is specified, so any build within those major ranges is vulnerable.

The CVSS score of 2.7 indicates low to moderate severity, with the vector showing a network‑based attack from an attacker with high privileges but no user interface. EPSS is not available and the flaw is not in the CISA KEV catalog, suggesting that widespread exploitation is unlikely at present. However, systems that expose Oracle Net to untrusted networks and use the Query Optimizer privilege remain at risk. The attacker must first authenticate as a high‑privileged user; once that is achieved, the vulnerability permits read access to constrained data sets.