CVE-2026-47039
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Vulnerability in the Java VM component of Oracle Database Server allows a low-privileged attacker with Create Session privilege and network access via Oracle Net to unauthorized create, delete, or modify critical data. The attack is easy to exploit.
Risk Assessment
The risk involves integrity compromise of Oracle database data, potentially leading to loss or manipulation of sensitive information.
Recommendation
It is recommended to immediately apply Oracle patches for affected versions (19.3-19.31, 21.3-21.22, 23.4.0-23.26.2).
Other vulnerabilities in Oracle Database Server
See all- CVE-2026-71064Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-71063Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-61211Critical
Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.
- CVE-2026-46833Critical
Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).
- CVE-2026-71100Medium
Vulnerability in the RDBMS component of Oracle Database Server, affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Easily exploitable by unauthenticated attacker over network (Oracle Net). Successful attack can allow unauthorized read access to a subset of data.
- CVE-2026-71062High
Vulnerability in the RDBMS component of Oracle Database Server affects versions 23.4.0-23.26.3. A low-privileged attacker (Authenticated User) via Oracle Net, under difficult conditions, can take over the system and impact other products.
- CVE-2026-60175High
Vulnerability in the RDBMS component of Oracle Database Server allows a low-privileged attacker (Authenticated User) with network access via Oracle Net to compromise the database. No user interaction is required.
- CVE-2026-47061Medium
Vulnerability in the JDBC component of Oracle Database Server allows an unauthenticated attacker with access to the communication segment to gain unauthorized access to critical data. Requires user interaction.
- CVE-2026-47060Medium
Vulnerability in the JDBC component of Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2). An unauthenticated attacker via Oracle Net, requiring user interaction, can gain unauthorized access to critical data (modify, delete, create).
- CVE-2026-47046High
Vulnerability in the RDBMS component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via Oracle Net can cause a complete denial of service (DoS) and unauthorized modification, insertion, or deletion of some data.
Original NVD description (English source)
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).