CVE-2026-47046

Received Received - Intake

Denial of Service in Oracle Database Server RDBMS

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS as well as unauthorized update, insert or delete access to some of RDBMS accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47046

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	database_server	From 23.4.0 (inc) to 23.26.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0 to 23.26.2. It allows an unauthenticated attacker with network access to cause a denial of service (DOS) or crash the database repeatedly. It may also permit unauthorized data modifications.

Detection Guidance

Detection requires checking Oracle Database Server versions. Affected versions are 23.4.0 to 23.26.2. Verify installed version using Oracle utilities like SQL*Plus with query: SELECT * FROM v$version. Network detection involves scanning for Oracle Net listeners on port 1521 or other configured ports.

Impact Analysis

If exploited, this vulnerability could lead to database crashes, data corruption, or unauthorized changes to your data. This disrupts database operations and may cause downtime or loss of critical information.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR and HIPAA requirements for data integrity and confidentiality. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Apply Oracle's Critical Patch Update immediately. If immediate patching is not possible, restrict network access to Oracle Net ports using firewalls. Disable unnecessary Oracle services and monitor for unusual database activity. Consider upgrading to a non-affected version if possible.

Hi! I’m here to help you understand CVE-2026-47046. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70