CVE-2026-60175

Analyzed Analyzed - Analysis Complete

RDBMS Component Takeover in Oracle Database Server

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60175

EUVD

EUVD-2026-46581

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	database_server	From 19.3 (inc) to 19.31 (inc)
oracle	database_server	From 21.3 (inc) to 21.22 (inc)
oracle	database_server	From 23.4 (inc) to 23.26.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in the RDBMS component of Oracle Database Server affecting versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. It allows a low-privileged authenticated attacker with network access to potentially take over the database server.

Detection Guidance

This vulnerability requires authenticated network access to exploit, so detection should focus on monitoring for unusual database activity or unauthorized access attempts. Check Oracle Database logs for suspicious connections or queries from low-privilege users. Use Oracle's built-in auditing tools like AUDIT_TRAIL to track database access and modifications.

Impact Analysis

An attacker could exploit this to gain full control of the Oracle Database Server, leading to unauthorized access, data theft, modification, or deletion. This could disrupt database operations and compromise sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or loss of sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for your affected Database Server versions immediately. Verify patch installation and ensure no unauthenticated users have access. Monitor Oracle Security Alerts for updates.

Hi! I’m here to help you understand CVE-2026-60175. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70