Oracle Database Server vulnerabilities
18 known CVE vulnerabilities in Oracle Database Server, translated and rated.
- CVE-2026-71064Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-71063Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-61211Critical
Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.
- CVE-2026-46833Critical
Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).
- CVE-2026-71100Medium
Vulnerability in the RDBMS component of Oracle Database Server, affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Easily exploitable by unauthenticated attacker over network (Oracle Net). Successful attack can allow unauthorized read access to a subset of data.
- CVE-2026-71062High
Vulnerability in the RDBMS component of Oracle Database Server affects versions 23.4.0-23.26.3. A low-privileged attacker (Authenticated User) via Oracle Net, under difficult conditions, can take over the system and impact other products.
- CVE-2026-60175High
Vulnerability in the RDBMS component of Oracle Database Server allows a low-privileged attacker (Authenticated User) with network access via Oracle Net to compromise the database. No user interaction is required.
- CVE-2026-47061Medium
Vulnerability in the JDBC component of Oracle Database Server allows an unauthenticated attacker with access to the communication segment to gain unauthorized access to critical data. Requires user interaction.
- CVE-2026-47060Medium
Vulnerability in the JDBC component of Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2). An unauthenticated attacker via Oracle Net, requiring user interaction, can gain unauthorized access to critical data (modify, delete, create).
- CVE-2026-47046High
Vulnerability in the RDBMS component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via Oracle Net can cause a complete denial of service (DoS) and unauthorized modification, insertion, or deletion of some data.
- CVE-2026-47045Medium
Vulnerability in the JDBC component of Oracle Database Server in versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Easily exploitable flaw requires human interaction and allows a high-privileged attacker with network access via Oracle Net to take over the JDBC component.
- CVE-2026-47039Medium
Vulnerability in the Java VM component of Oracle Database Server allows a low-privileged attacker with Create Session privilege and network access via Oracle Net to unauthorized create, delete, or modify critical data. The attack is easy to exploit.
- CVE-2026-47038Low
Vulnerability in RDBMS component of Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Easily exploitable by high-privileged attacker with network access via Oracle Net. Successful attack may lead to unauthorized data modification.
- CVE-2026-46975Medium
Vulnerability in the RDBMS component of Oracle Database Server. Affects versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. An unauthenticated attacker with network access via Oracle Net can exploit it without user interaction. Successful attack allows unauthorized update, insert, or delete access to some RDBMS data, with potential impact on additional products (scope change).
- CVE-2026-46835High
Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via TLS can cause a hang or frequent crash (complete DoS) of the service.
- CVE-2026-46834High
Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via TLS can cause a hang or frequently repeatable crash (complete DOS) of Net Service.
- CVE-2026-21999Medium
Vulnerability in the XML Database component of Oracle Database Server allows an unauthenticated attacker remote access via HTTPS to confidential data. It requires user interaction and is difficult to exploit.
- CVE-2021-2351High
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Affected versions are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit, allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction and may significantly impact additional products. Successful attacks can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces Native Network Encryption changes to address this vulnerability. CVSS 3.1 Base Score 8.3.