CVE-2026-35229

Analyzed Analyzed - Analysis Complete

Unauthorized Access via Java VM Vulnerability in Oracle Database

Publication date: 2026-04-21

Last updated on: 2026-05-05

Assigner: Oracle

Description

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.30 and 21.3-21.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java VM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-21

Last Modified

2026-05-05

Generated

2026-07-06

AI Q&A

2026-04-22

EPSS Evaluated

2026-07-05

NVD

CVE-2026-35229

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	java_virtual_machine	From 19.3 (inc) to 19.30 (inc)
oracle	java_virtual_machine	From 21.3 (inc) to 21.21 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Compliance Impact

This vulnerability allows an unauthenticated attacker with network access to compromise the Java VM component of Oracle Database Server, potentially resulting in unauthorized access to critical or all Java VM accessible data.

Such unauthorized access to sensitive data could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding confidential information against unauthorized access.

However, the provided information does not explicitly describe the direct effects on compliance with these standards.

Executive Summary

This vulnerability exists in the Java VM component of the Oracle Database Server, specifically affecting versions 19.3 to 19.30 and 21.3 to 21.21.

It is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via Oracle Net to compromise the Java VM.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through the Java VM.

Impact Analysis

The impact of this vulnerability is significant because it allows an attacker to gain unauthorized access to critical or all data accessible by the Java VM component of the Oracle Database Server.

Since the vulnerability can be exploited without authentication and remotely over the network, it poses a high risk of data compromise.

The CVSS score of 7.5 indicates a high severity, primarily affecting confidentiality, meaning sensitive information could be exposed.

Hi! I’m here to help you understand CVE-2026-35229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70