CVE-2026-35229
Unauthorized Access via Java VM Vulnerability in Oracle Database
Publication date: 2026-04-21
Last updated on: 2026-05-05
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | java_virtual_machine | From 19.3 (inc) to 19.30 (inc) |
| oracle | java_virtual_machine | From 21.3 (inc) to 21.21 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Java VM component of the Oracle Database Server, specifically affecting versions 19.3 to 19.30 and 21.3 to 21.21.
It is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via Oracle Net to compromise the Java VM.
Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through the Java VM.
How can this vulnerability impact me? :
The impact of this vulnerability is significant because it allows an attacker to gain unauthorized access to critical or all data accessible by the Java VM component of the Oracle Database Server.
Since the vulnerability can be exploited without authentication and remotely over the network, it poses a high risk of data compromise.
The CVSS score of 7.5 indicates a high severity, primarily affecting confidentiality, meaning sensitive information could be exposed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker with network access to compromise the Java VM component of Oracle Database Server, potentially resulting in unauthorized access to critical or all Java VM accessible data.
Such unauthorized access to sensitive data could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding confidential information against unauthorized access.
However, the provided information does not explicitly describe the direct effects on compliance with these standards.