CVE-2026-61211

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Oracle Database Server RDBMS

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Execute DBMS_CLOUD privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61211

EUVD

EUVD-2026-47413

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	database_server	From 19.3 (inc) to 19.31 (inc)
oracle	database_server	From 23.4 (inc) to 23.26.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in the RDBMS component of Oracle Database Server affecting versions 19.3-19.31 and 23.4.0-23.26.2. It allows a low-privileged attacker with Execute DBMS_CLOUD privilege to compromise the RDBMS via network access. Successful exploitation can lead to full takeover of the RDBMS.

Detection Guidance

Detection requires checking Oracle Database Server versions 19.3-19.31 or 23.4.0-23.26.2 for the vulnerable RDBMS component. Use SQL queries to verify installed versions and privileges. Check for unauthorized access attempts or unusual activity in logs.

Impact Analysis

An attacker could gain control of the Oracle Database Server, leading to unauthorized access, data theft, data manipulation, or service disruption. This could affect confidentiality, integrity, and availability of critical database resources.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for your affected Database Server versions (19.3-19.31 or 23.4.0-23.26.2) to address the RDBMS component vulnerability. Remove or restrict Execute DBMS_CLOUD privilege from low-privileged users until patched. Monitor Oracle security advisories for updates and isolate database servers from untrusted networks.

Hi! I’m here to help you understand CVE-2026-61211. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70