The RDBMS component of Oracle Database Server contains an easily exploitable flaw that permits a low‑privileged attacker with Create Session rights to obtain unauthorized access. When leveraged, the attacker can read critical data or gain full access to all data exposed by the database. The vulnerability also carries a scope change that may affect other Oracle products, potentially expanding the impact beyond the immediate database. This results in a high impact on confidentiality but no direct integrity or availability loss.

Oracle Corporation’s Oracle Database Server is impacted. Supported versions affected range from 23.4.0 through 23.26.3. The issue must be addressed for any installation within this version span.

The CVSS score of 7.7 indicates a high severity vulnerability. The exploit is likely to occur over the network via Oracle Net and requires only Create Session privilege. While the EPSS score is unavailable, the lack of listed KEV status suggests no widespread exploitation yet, but the scope change raises the potential for broader compromise if additional Oracle products are involved. The attack vector is inferred from the description of network access via Oracle Net for an attacker with limited privileges.