CVE-2026-47061: 
Oracle Database Server vulnerability analysis and mitigation

CVE-2026-47061 is an Improper Access Control (CWE-284) vulnerability in the JDBC component of Oracle Database Server, enabling unauthorized access to sensitive data. It was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update (CPUJul2026). Affected versions include Oracle Database Server 19.3–19.31, 21.3–21.22, and 23.4.0–23.26.2. The vulnerability carries a CVSS v3.1 base score of 5.6 (Medium) (Oracle Advisory). The vulnerability was reported to Oracle by Alexander Kornbrust of Red Database Security (Oracle Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control) and resides in the JDBC component of Oracle Database Server. An unauthenticated attacker with access to the physical communication segment (adjacent network) where the JDBC component executes can exploit this flaw. Exploitation is rated as difficult (high attack complexity), requires human interaction from a person other than the attacker, and results in a scope change — meaning successful exploitation can impact components beyond the JDBC subsystem itself. The attack vector is adjacent network (AV:A), meaning the attacker must be on the same physical or logical network segment as the target (Oracle Advisory).

Successful exploitation results exclusively in a confidentiality impact — specifically, unauthorized access to critical data or complete access to all JDBC-accessible data. There is no integrity or availability impact. Because the scope changes upon successful exploitation, data accessible through JDBC connections (potentially including sensitive database contents) in other products or components may also be exposed. The attack requires human interaction, limiting opportunistic exploitation but not eliminating risk in targeted scenarios (Oracle Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Oracle Advisory). The EPSS score is approximately 0.00159 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity and requirement for adjacent network access and human interaction significantly reduce the likelihood of widespread exploitation.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update (CPUJul2026), published on July 21, 2026. Administrators should apply the relevant patches for their affected versions (19.3–19.31, 21.3–21.22, or 23.4.0–23.26.2) as soon as possible. As interim mitigations, Oracle recommends restricting physical and logical access to network segments where JDBC components operate, implementing network segmentation to limit adjacent network access, and monitoring JDBC connections for anomalous activity. Oracle strongly advises against relying on network-level blocking as a long-term solution (Oracle Advisory).