Description

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:10.263Z",
  "pubdate": "2026-08-18T21:18:10.263Z",
  "executiveSummary": "A vulnerability exists within the RDBMS component of Oracle Database Server, specifically affecting supported versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. This security flaw allows an unauthenticated remote attacker with network access via the Oracle Net protocol to compromise the relational database management system.\nThe primary impact of successful exploitation is limited to unauthorized read access to a subset of data accessible by the RDBMS, resulting in a breach of confidentiality without affecting data integrity or system availability. The vulnerability presents a low barrier to entry for threat actors due to the lack of required privileges, user interaction, or authentication.\nThe CVSS 3.1 Base Score is 5.3, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, highlighting the network vector and low attack complexity. Risk implications include the exposure of sensitive database contents to unauthorized entities over the network, potentially violating compliance mandates and exposing proprietary organizational information. Organizations utilizing the affected Oracle Database Server versions must prioritize remediation to prevent potential data exfiltration via the Oracle Net listener.",
  "technicalDetails": "The vulnerability resides in the RDBMS component of Oracle Database Server, specifically concerning how network interactions and data queries are handled over the Oracle Net protocol. The root cause stems from insufficient validation or authorization enforcement within internal database routines exposed via the network stack, enabling unauthorized retrieval of specific data subsets without validating the caller's session privileges.\nExploitation of this vulnerability requires network connectivity to the database listener utilizing the Oracle Net protocol. An unauthenticated attacker initiates a connection to the target database instance over the network. By crafting specialized protocol messages or requests targeting the vulnerable RDBMS component, the attacker bypasses standard access control mechanisms designed to restrict data visibility.\nThe attack flow proceeds as follows: First, the attacker establishes a network connection to the Oracle Database listener port, typically TCP port 1521 or a custom-configured listener port. Second, the attacker interacts with the RDBMS component via Oracle Net without providing valid user credentials or establishing an authenticated session. Third, the crafted request triggers the flawed data retrieval routine within the database engine. Finally, the vulnerable component returns the requested subset of data to the attacker, resulting in unauthorized information disclosure.\nThe attack vector is entirely network-based (AV:N), with low attack complexity (AC:L) as it does not require specialized conditions or race-conditions to execute. Zero privileges (PR:N) and zero user interaction (UI:N) are required, meaning any entity capable of reaching the Oracle Net listener can initiate the exploit. The scope remains unchanged (S:U), as the vulnerability impacts solely the confidentiality (C:L) of the RDBMS data without compromising underlying operating system resources or other security domains. Post-exploitation impact is strictly confined to the unauthorized read access of accessible database subsets, potentially leaking sensitive records, configuration data, or operational metrics depending on the exposed database schema."
}