CVE-2026-83156

Received Received - Intake

Oracle XML Developers Kit Remote Code Execution

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle XML Developers Kit component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having XDKC privilege with network access via Oracle Net to compromise Oracle XML Developers Kit. Successful attacks of this vulnerability can result in takeover of Oracle XML Developers Kit. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83156

EUVD

EUVD-2026-79483

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	xml_developers_kit	From 19.3 (inc) to 19.32 (inc)
oracle	xml_developers_kit	From 21.3 (inc) to 21.23 (inc)
oracle	xml_developers_kit	From 23.4.0 (inc) to 23.26.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Oracle XML Developers Kit component of Oracle Database Server. It affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with XDKC privilege can exploit it via network access to take over the XML Developers Kit.

Detection Guidance

Detection of this vulnerability requires checking for vulnerable versions of Oracle XML Developers Kit in Oracle Database Server. Review installed Oracle Database versions against affected ranges (19.3-19.32, 21.3-21.23, 23.4.0-23.26.3). Check for the presence of the XDKC privilege assigned to low-privileged users.

Impact Analysis

Successful exploitation could lead to complete compromise of the Oracle XML Developers Kit, resulting in loss of confidentiality, integrity, and availability of data processed by this component.

Compliance Impact

The vulnerability allows low-privileged attackers to compromise the Oracle XML Developers Kit, potentially leading to unauthorized access, data breaches, or system takeover. This could impact compliance with GDPR by risking unauthorized data access or processing, and with HIPAA by compromising protected health information integrity and confidentiality.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for your affected Oracle Database Server version to address the vulnerability in the XML Developers Kit component.

Hi! I’m here to help you understand CVE-2026-83156. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70