CVE-2026-47046
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Vulnerability in the RDBMS component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via Oracle Net can cause a complete denial of service (DoS) and unauthorized modification, insertion, or deletion of some data.
Risk Assessment
Risk of database downtime and data integrity compromise, potentially affecting all applications using Oracle Database.
Recommendation
Apply the latest Oracle security patches for Oracle Database Server (versions 23.4.0-23.26.2).
Other vulnerabilities in Oracle Database Server
See all- CVE-2026-71064Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-71063Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-61211Critical
Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.
- CVE-2026-46833Critical
Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).
- CVE-2026-71100Medium
Vulnerability in the RDBMS component of Oracle Database Server, affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Easily exploitable by unauthenticated attacker over network (Oracle Net). Successful attack can allow unauthorized read access to a subset of data.
- CVE-2026-71062High
Vulnerability in the RDBMS component of Oracle Database Server affects versions 23.4.0-23.26.3. A low-privileged attacker (Authenticated User) via Oracle Net, under difficult conditions, can take over the system and impact other products.
- CVE-2026-60175High
Vulnerability in the RDBMS component of Oracle Database Server allows a low-privileged attacker (Authenticated User) with network access via Oracle Net to compromise the database. No user interaction is required.
- CVE-2026-47061Medium
Vulnerability in the JDBC component of Oracle Database Server allows an unauthenticated attacker with access to the communication segment to gain unauthorized access to critical data. Requires user interaction.
- CVE-2026-47060Medium
Vulnerability in the JDBC component of Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2). An unauthenticated attacker via Oracle Net, requiring user interaction, can gain unauthorized access to critical data (modify, delete, create).
- CVE-2026-47045Medium
Vulnerability in the JDBC component of Oracle Database Server in versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Easily exploitable flaw requires human interaction and allows a high-privileged attacker with network access via Oracle Net to take over the JDBC component.
Original NVD description (English source)
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS as well as unauthorized update, insert or delete access to some of RDBMS accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).