CVE-2025-53047
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in the Portable Clusterware component of Oracle Database Server allows an unauthenticated attacker with network access via Bonjour to compromise Portable Clusterware. Successful attacks can result in unauthorized read access to a subset of data. Affects versions 19.3-19.28, 21.3-21.19, 23.4-23.9.
Risk Assessment
An attacker can access data without authorization, affecting confidentiality. The attack is easily exploitable over the network.
Recommendation
Apply patches from Oracle or restrict network access to Bonjour service.
Other vulnerabilities in Oracle Database Server
See all- CVE-2026-71064Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-71063Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-61211Critical
Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.
- CVE-2026-46833Critical
Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).
- CVE-2026-83351High
Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. A difficult to exploit flaw allows an unauthenticated attacker with network access via Oracle Net to compromise RDBMS.
- CVE-2026-83348High
Vulnerability in the RDBMS component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. An easily exploitable flaw allows a low-privileged attacker having Create DB Link privilege with network access via Oracle Net to compromise RDBMS.
- CVE-2026-83272High
Vulnerability in the Oracle Text component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with Create Index privilege and network access via Oracle Net can compromise Oracle Text. The vulnerability is difficult to exploit but may impact additional products (scope change).
- CVE-2026-83271High
Vulnerability in the RDBMS component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with Execute on DBMS_REDEFINITION privilege and network access via Oracle Net can compromise RDBMS. The vulnerability is easily exploitable.
- CVE-2026-83160High
Vulnerability in the RDBMS component of Oracle Database Server in versions 23.4.0-23.26.3. Easily exploitable, allows attacker with Create Table privilege via Oracle Net to take over RDBMS.
- CVE-2026-83156High
Vulnerability in the Oracle XML Developers Kit component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with XDKC privilege and network access via Oracle Net can take over Oracle XML Developers Kit.
Original NVD description (English source)
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via Bonjour to compromise Portable Clusterware. While the vulnerability is in Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Portable Clusterware accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS