Description
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having None privilege with network access via SOCKS5 to compromise Java VM. While the vulnerability is in Java VM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N).
Published: 2026-10-20
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Integrity Compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Java VM component of Oracle Database Server. A low-privileged attacker with no elevated privileges who can reach the database over the network through a SOCKS5 proxy may exploit the flaw. Successful exploitation enables unauthorized creation, deletion or modification of critical data or any data accessible through the Java VM. The flaw primarily leads to integrity compromise, and because the Java VM is used by other Oracle products, the effect can extend to those products as well.

Affected Systems

The affected product is Oracle Database Server from Oracle Corporation. Versions impacted are 19.3 through 19.32, 21.3 through 21.23 and 23.4.0 through 23.26.3.

Risk and Exploitability

The CVSS base score is 6.3, indicating a moderate level of severity. The exploit is considered difficult to carry out, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack vector is remote network access via SOCKS5, requiring a low-privileged attacker. Because the scope changes from the Java VM to other Oracle products, the potential impact is broader than the immediate component.

Generated by OpenCVE AI on October 21, 2026 at 11:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Database Server patches for the affected versions.
  • Limit or disable SOCKS5 proxy access to the database server, and use firewall rules to restrict network reachability.
  • Enforce strict access controls and proper authentication for Java VM operations to prevent unauthorized data modification.

Generated by OpenCVE AI on October 21, 2026 at 11:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle database Server
Oracle Corporation
Oracle Corporation oracle Database Server
Vendors & Products Oracle database Server
Oracle Corporation
Oracle Corporation oracle Database Server

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Title Java VM Vulnerability Enabling Unauthorized Data Modification in Oracle Database Server
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having None privilege with network access via SOCKS5 to compromise Java VM. While the vulnerability is in Java VM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N).
First Time appeared Oracle
Oracle database - Java Vm
CPEs cpe:2.3:a:oracle:database_-_java_vm:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle database - Java Vm
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N'}

Subscriptions

Oracle Database - Java Vm Database Server
Oracle Corporation Oracle Database Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:50:59.781Z

Reserved: 2026-09-14T22:10:16.648Z

Link: CVE-2026-91615

cve-icon Vulnrichment

Updated: 2026-10-26T20:50:54.183Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:21:01.780

Modified: 2026-10-26T21:20:56.887

Link: CVE-2026-91615

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T14:45:06Z

Weaknesses