CVE-2026-47060: 
Oracle Database Server vulnerability analysis and mitigation

CVE-2026-47060 is an Improper Access Control vulnerability in the JDBC component of Oracle Database Server, allowing unauthenticated network attackers to tamper with critical data. Affected versions include 19.3–19.31, 21.3–21.22, and 23.4.0–23.26.2. The vulnerability was disclosed on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle Advisory). The vulnerability was reported to Oracle by Alexander Kornbrust of Red Database Security (Oracle Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) in the JDBC component of Oracle Database Server. An unauthenticated attacker with network access via the Oracle Net protocol can exploit this flaw with low attack complexity, though successful exploitation requires human interaction from a third party (e.g., a social engineering component). The flaw enables unauthorized creation, deletion, or modification of critical data or all data accessible through JDBC, but does not impact confidentiality or availability (Oracle Advisory). No public proof-of-concept or detailed technical write-up has been disclosed at this time.

Successful exploitation results in a high integrity impact, allowing an attacker to create, delete, or modify critical data or all JDBC-accessible data within the Oracle Database Server. There is no confidentiality or availability impact associated with this vulnerability. The scope is unchanged, meaning the impact is confined to the JDBC component itself, though data tampering at the database level could have significant downstream consequences for dependent applications and business processes (Oracle Advisory).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation as of the time of disclosure. The NVD SSVC assessment classifies exploitation as "none" and the technical impact as "partial," and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0023 (0.23%), indicating a low probability of exploitation in the near term (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update, published on July 21, 2026. Administrators should apply the CPU patches to all affected Oracle Database Server versions (19.3–19.31, 21.3–21.22, 23.4.0–23.26.2) as soon as possible. As interim mitigations, Oracle recommends restricting network access to Oracle Net ports to trusted clients only and implementing network segmentation to limit exposure of Oracle Database servers. User awareness training is also advisable given the human interaction requirement for exploitation (Oracle Advisory).