CVE-2026-34312
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in the RDBMS component of Oracle Database Server affects versions 19.3-19.30. A high-privileged attacker with Row Access Method privilege and network access can exploit it, but human interaction is required. Successful attacks may result in unauthorized read access to a subset of RDBMS data (CVSS 2.4).
Risk Assessment
The risk primarily affects confidentiality — a highly privileged attacker could access data they should not. Required user interaction lowers the likelihood but does not eliminate the threat.
Recommendation
Apply the available Oracle Critical Patch Update for 19.x versions. Restrict Row Access Method privileges to the minimum necessary and monitor for unusual queries.
Other vulnerabilities in Oracle Database Server
See all- CVE-2026-101512Medium
Vulnerability in the RDBMS component of Oracle Database Server affects versions 23.4.0-23.26.3. An easily exploitable flaw allows a low-privileged attacker with no special privileges and network access via HTTP to gain unauthorized access to critical data or complete access to all RDBMS data.
- CVE-2026-71064Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-71063Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-61211Critical
Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.
- CVE-2026-46833Critical
Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).
- CVE-2026-91615Medium
Vulnerability in the Java VM component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. A difficult to exploit flaw allows a low-privileged attacker with network access via SOCKS5 to perform unauthorized creation, deletion or modification of critical data.
- CVE-2026-91568High
Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. An easily exploitable Oracle Net attack allows a low-privileged attacker with Create Session privilege to gain unauthorized access to critical data, potentially impacting other products.
- CVE-2026-91563High
Vulnerability in the Oracle OLAP component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. An easily exploitable Oracle Net attack allows a low-privileged attacker with DBMS_AW privilege to take over Oracle OLAP.
- CVE-2026-91503High
Vulnerability in the VPD component of Oracle Database Server. A low privileged attacker with Create Table privilege can exploit it over the network via Oracle Net to gain unauthorized creation, deletion or modification access to VPD data. CVSS 8.1.
- CVE-2026-91499High
Vulnerability in the RDBMS component of Oracle Database Server. A low privileged attacker with DBMS_VECTOR privilege can exploit it over the network via Oracle Net to take over RDBMS. CVSS 8.8.
Original NVD description (English source)
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.30. Easily exploitable vulnerability allows high privileged attacker having Row Access Method privilege with network access via multiple protocols to compromise RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS