CVE-2026-47046 in Database Server
Summary
by MITRE • 07/22/2026
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS as well as unauthorized update, insert or delete access to some of RDBMS accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Database Server's RDBMS component and affects a specific range of versions from 23.4.0 through 23.26.2, representing a significant security concern for database environments that have not yet been updated to newer releases. The flaw manifests as an easily exploitable weakness that requires minimal prerequisites for exploitation, as it permits unauthenticated attackers to gain network access via Oracle Net protocols. The vulnerability's classification as easily exploitable indicates that the attack vector requires little technical sophistication or specialized tools, making it particularly dangerous for environments where database servers are accessible over networks without proper security controls.
The technical nature of this flaw allows an attacker to compromise the RDBMS through network-based attacks leveraging Oracle Net communication protocols, which represent the standard interface for client-server communication with Oracle Database systems. When successfully exploited, the vulnerability enables attackers to achieve complete denial of service conditions by causing database server hangs or repeated crashes that can render the entire system unusable for legitimate users and applications. This represents a critical availability impact that can severely disrupt business operations and data access capabilities.
The security implications extend beyond simple service disruption as the vulnerability also provides unauthorized access rights that permit attackers to modify database content through update, insert, or delete operations on specific portions of the database. This integrity compromise creates potential for data corruption, information leakage, and unauthorized modifications that could fundamentally alter organizational data assets. The CVSS 3.1 base score of 8.2 reflects the severity of both integrity and availability impacts, with the availability impact rated as high due to the complete denial of service capabilities.
From a threat modeling perspective, this vulnerability aligns with ATT&CK techniques related to privilege escalation and denial of service operations, while also mapping to CWE categories involving insufficient input validation and network protocol vulnerabilities. The attack vector AV:N indicates network accessibility without authentication requirements, while the low attack complexity AC:L suggests that exploitation does not require significant technical expertise or resources. The lack of required privileges PR:N and user interaction UI:N further emphasizes how accessible this vulnerability is to attackers who may not possess legitimate credentials or specific system access rights.
Organizations should prioritize immediate patching of affected Oracle Database Server installations to address this vulnerability, as the combination of availability and integrity impacts makes it particularly dangerous for production environments. The recommended mitigation strategy includes applying the appropriate Oracle security patches that specifically address this RDBMS vulnerability, while also implementing network segmentation controls to limit unnecessary Oracle Net access. Additional monitoring should be deployed to detect potential exploitation attempts through anomalous database connection patterns or unusual network traffic originating from Oracle Net protocols. Security teams should also consider implementing network firewalls and access controls to restrict Oracle Net communication to only trusted administrative networks and authorized client systems, thereby reducing the attack surface for this vulnerability.