CVE-2026-47045

MEDIUM

Oracle DB 19.3-19.31/21.3-21.22/23.4-23.26.2 Auth RCE via JDBC Oracle Net

Title source: llm

Description

Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows high privileged attacker having None privilege with network access via Oracle Net to compromise JDBC. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JDBC. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

Oracle Advisory

https://www.oracle.com/security-alerts/cpujul2026.html

Scores

CVSS v3 6.8

EPSS 0.0026

EPSS Percentile 17.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-601

Status published

Products (3)

Oracle Corporation/Oracle Database Server 19.3 - 19.31

Oracle Corporation/Oracle Database Server 21.3 - 21.22

Oracle Corporation/Oracle Database Server 23.4.0 - 23.26.2

Published Jul 21, 2026

Tracked Since Jul 22, 2026