CVE-2026-47060

Received Received - Intake

JDBC Component Unauthorized Data Access in Oracle Database

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JDBC. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JDBC accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47060

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	database_server	From 19.3 (inc) to 19.31 (inc)
oracle	database_server	From 21.3 (inc) to 21.22 (inc)
oracle	database_server	From 23.4.0 (inc) to 23.26.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the JDBC component of Oracle Database Server affecting versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. It allows an unauthenticated attacker with network access to potentially compromise the JDBC component. Exploitation requires human interaction from someone other than the attacker. Successful attacks can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via JDBC.

Detection Guidance

Detection requires checking if your Oracle Database Server version falls within the affected ranges (19.3-19.31, 21.3-21.22, 23.4.0-23.26.2). Use SQL queries like SELECT * FROM v$version to identify the version. Network monitoring for unusual JDBC-related traffic may also help.

Impact Analysis

If exploited, this vulnerability could allow attackers to modify or delete critical data stored in the Oracle Database Server without authentication. This could lead to data corruption, loss of sensitive information, or unauthorized changes to business-critical data. The impact is limited to data integrity as the CVSS score indicates no confidentiality or availability impact.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized modifications to personal or health-related data. GDPR requires protection against unauthorized data alteration, while HIPAA mandates integrity controls for protected health information. Exploitation could lead to violations of these regulations, resulting in legal penalties or loss of compliance certifications.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for your database version immediately. Disable unnecessary JDBC connections if possible. Restrict network access to the database via firewalls to limit exposure. Monitor critical data for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-47060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70