CVE-2026-47061 in Database Server
Summary
by MITRE • 07/22/2026
Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JDBC executes to compromise JDBC. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JDBC, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JDBC accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under consideration resides within Oracle Database Server's JDBC component, representing a significant security weakness that affects multiple version ranges including 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2. This flaw operates at the database connectivity layer where JDBC (Java Database Connectivity) serves as the bridge between Java applications and database systems, making it a critical component for enterprise data access operations. The vulnerability's classification as difficult to exploit indicates that while the attack vector is not trivial, it remains a serious concern given the potential for unauthorized data access.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the JDBC execution environment, specifically when the JDBC component operates on hardware connected to a physical communication segment. This configuration creates an attack surface where an unauthenticated malicious actor positioned on the same network segment can potentially compromise the JDBC component without requiring traditional authentication credentials. The requirement for human interaction beyond the initial attacker suggests that additional operational factors or user actions may be necessary to complete the exploitation process, though the vulnerability itself remains accessible through physical network proximity.
The operational impact of this vulnerability extends far beyond the immediate JDBC component, as evidenced by the CVSS scope change vector element indicating potential influence on additional products. This characteristic suggests that successful exploitation could enable attackers to access not just JDBC-specific data but potentially compromise broader database ecosystem components, creating cascading security implications throughout the enterprise infrastructure. The confidentiality impact rating of high severity reflects the potential for unauthorized access to critical data, which aligns with CWE-284 (Improper Access Control) and represents a fundamental breach in data protection mechanisms.
From a threat modeling perspective, this vulnerability maps to ATT&CK technique T1046 (Network Service Scanning) and T1071.004 (Application Layer Protocol: DNS) as attackers would need to identify and position themselves within the network segment where JDBC operates. The CVSS vector analysis reveals an attack complexity of high, indicating that while the vulnerability exists, exploitation requires specific conditions including physical network access and potentially additional human factors. The base score of 5.6 represents a medium severity threat that escalates in impact when considering potential scope changes affecting multiple system components.
Mitigation strategies should focus on implementing robust network segmentation to prevent unauthorized physical access to database hardware, deploying network access controls to limit JDBC component exposure, and ensuring regular patching of affected Oracle Database versions. The principle of least privilege should be enforced at the JDBC level, with strict access controls limiting data exposure. Organizations should also consider implementing network monitoring solutions that can detect anomalous JDBC access patterns and establish incident response procedures specifically addressing database connectivity vulnerabilities. The vulnerability's nature suggests that traditional perimeter-based security measures may be insufficient, requiring more comprehensive endpoint and network-based protections to effectively defend against physical network segment attacks targeting JDBC components.