CVE-2026-47061

Analyzed Analyzed - Analysis Complete

JDBC Component Access Vulnerability in Oracle Database Server

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JDBC executes to compromise JDBC. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JDBC, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JDBC accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-47061

EUVD

EUVD-2026-46547

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	database_server	From 19.3 (inc) to 19.31 (inc)
oracle	database_server	From 21.3 (inc) to 21.22 (inc)
oracle	database_server	From 23.4 (inc) to 23.26.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the JDBC component of Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. It allows an unauthenticated attacker with access to the physical network segment where JDBC runs to potentially compromise it. Exploitation requires human interaction from someone other than the attacker and may impact additional products beyond JDBC.

Detection Guidance

This vulnerability is specific to Oracle Database Server's JDBC component and requires physical network access to exploit. Detection involves checking Oracle Database Server versions for affected releases (19.3-19.31, 21.3-21.22, 23.4.0-23.26.2) and monitoring for unauthorized access attempts to JDBC components.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to critical data or complete access to all data accessible via JDBC. The impact is limited to confidentiality, with a CVSS score of 5.6 indicating moderate severity.

Compliance Impact

This vulnerability allows unauthorized access to critical or all JDBC-accessible data, which could lead to breaches of sensitive information. Such breaches may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy), potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for your affected Oracle Database Server versions (19.3-19.31, 21.3-21.22, 23.4.0-23.26.2) to address the JDBC component vulnerability. Restrict physical and network access to the database server to trusted users only.

Hi! I’m here to help you understand CVE-2026-47061. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70