CVE-2026-46975 in Database Server
Summary
by MITRE • 07/22/2026
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS accessible data. CVSS 3.1 Base Score 5.8 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Database Server's RDBMS component and affects specific version ranges including 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2. The flaw represents a significant security weakness that operates at the network level through Oracle Net protocol connections, making it particularly dangerous as it requires no authentication credentials for exploitation. The vulnerability's ease of exploitation means that any attacker with network access to the target system can potentially compromise database operations without needing valid user credentials or prior access rights.
The technical nature of this flaw allows an unauthenticated attacker to leverage network connectivity through Oracle Net services to gain unauthorized access to database operations. This vulnerability specifically impacts the integrity aspects of the database system as indicated by the CVSS 3.1 Base Score of 5.8 with an integrity impact rating of low. The attack vector requires network access from a remote location, with low attack complexity and no privilege requirements or user interaction needed for successful exploitation. The scope change aspect indicates that while the vulnerability is directly within RDBMS, its impact may extend to affect other Oracle products within the same ecosystem.
The operational consequences of this vulnerability are substantial as successful exploitation enables attackers to perform unauthorized update, insert, or delete operations on database records. This means that an attacker could modify existing data, add new entries, or remove information from database tables without detection, potentially causing significant data integrity issues and operational disruptions. The impact extends beyond simple data corruption as it affects the fundamental trustworthiness of database contents and could lead to business continuity issues if sensitive information becomes compromised.
Organizations should implement immediate mitigations including network segmentation to limit access to Oracle database ports, firewall rules restricting Oracle Net protocol access to trusted networks only, and ensuring all affected versions are patched according to Oracle's security advisory releases. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a critical concern for organizations operating Oracle Database environments. From an ATT&CK framework perspective, this vulnerability maps to techniques involving privilege escalation and data manipulation through network-based attacks, potentially enabling adversaries to establish persistence and conduct long-term data compromise operations within affected database systems.
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) demonstrates the vulnerability's characteristics where network accessibility, low attack complexity, and no privilege requirements make it particularly dangerous. The scope change classification indicates that impacts may extend beyond the primary RDBMS component to other Oracle products or integrated systems. Organizations should conduct thorough security assessments of their database environments, review network access controls for Oracle services, and implement monitoring solutions capable of detecting unauthorized database access attempts or modifications. Regular security updates and patch management processes become critical to maintaining database system integrity against such vulnerabilities that can potentially allow unauthorized data manipulation across multiple Oracle product lines.