Description

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-18T21:18:06.080Z",
  "pubdate": "2026-08-18T21:18:06.080Z",
  "executiveSummary": "A vulnerability exists within the RDBMS component of Oracle Database Server, specifically affecting supported versions 23.4.0-23.26.3. This security flaw allows a low-privileged, authenticated attacker with network access via Oracle Net to compromise the underlying Relational Database Management System.\nThe vulnerability is classified as difficult to exploit due to high attack complexity, but successful exploitation yields severe consequences, enabling a complete takeover of the RDBMS. Furthermore, the vulnerability exhibits a scope change (S:C), indicating that successful attacks may significantly impact additional products beyond the immediate RDBMS component.\nThe CVSS 3.1 base score is 8.5, reflecting high impacts across confidentiality, integrity, and availability. Attackers must possess authenticated user privileges and network connectivity via the Oracle Net protocol to initiate an attack vector.",
  "technicalDetails": "The vulnerability resides in the RDBMS component of Oracle Database Server across versions 23.4.0 through 23.26.3. The flaw is exposed via the Oracle Net protocol, requiring network-level access for initial interaction.\nExploitation requires the attacker to hold Authenticated User privileges within the database environment. Although authentication is mandatory, the required privilege level is low. The attack complexity is rated as high, implying that successful exploitation demands specific preconditions, precise timing, or handling of complex internal state mechanics by the threat actor.\nThe attack flow begins when an authenticated, low-privileged user leverages network access via Oracle Net to interact with vulnerable functions within the RDBMS component. Due to insufficient input validation, memory safety issues, or improper authorization checks within the targeted component, the attacker injects or manipulates crafted payloads through the protocol interface.\nBecause the vulnerability involves a scope change (S:C), the execution of malicious payloads transcends the privilege boundaries of the initial RDBMS component, potentially granting unauthorized access and control over associated software products or underlying operating system resources managed within the ecosystem.\nUpon successful execution of the exploit chain, the attacker achieves a complete takeover of the RDBMS. This results in total compromise of the database management system, allowing the adversary to read, modify, or delete sensitive data (high confidentiality and integrity impact), as well as disrupt database services entirely (high availability impact)."
}