CVE-2026-47060: Medium severity Oracle Oracle Database Server (JDBC) vulnerability
Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JDBC. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JDBC accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Limit network access to Oracle Net (port(s) used by Oracle Net) so unauthenticated attackers cannot reach the Oracle Database Server over the network.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47060?
The severity of CVE-2026-47060 is classified as medium with a score of 6.5.
How do I fix CVE-2026-47060?
To fix CVE-2026-47060, it is recommended to apply the latest patches provided by Oracle for the affected database versions.
What versions of Oracle Database Server are affected by CVE-2026-47060?
CVE-2026-47060 affects Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2.
What type of access is required to exploit CVE-2026-47060?
An unauthenticated attacker with network access via Oracle Net is required to exploit CVE-2026-47060.
What impact can an attack exploiting CVE-2026-47060 have?
Successful exploitation of CVE-2026-47060 can lead to high integrity impacts, compromising the JDBC component of Oracle Database Server.