CVE-2026-47039

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47039", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-05-18T15:55:10.318Z", "datePublished": "2026-07-21T21:33:10.947Z", "dateUpdated": "2026-07-23T15:36:03.902Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-07-21T21:33:10.947Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Database Server", "versions": [{"version": "19.3", "status": "affected", "lessThanOrEqual": "19.31", "versionType": "custom"}, {"version": "21.3", "status": "affected", "lessThanOrEqual": "21.22", "versionType": "custom"}, {"version": "23.4.0", "status": "affected", "lessThanOrEqual": "23.26.2", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:database_-_java_vm:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.3", "versionEndIncluding": "19.31"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:database_-_java_vm:*:*:*:*:*:*:*:*", "versionStartIncluding": "21.3", "versionEndIncluding": "21.22"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:database_-_java_vm:*:*:*:*:*:*:*:*", "versionStartIncluding": "23.4.0", "versionEndIncluding": "23.26.2"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T15:35:39.328841Z", "id": "CVE-2026-47039", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T15:36:03.902Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47039", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T15:35:39.328841Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T15:35:57.261Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Database Server", "versions": [{"status": "affected", "version": "19.3", "versionType": "custom", "lessThanOrEqual": "19.31"}, {"status": "affected", "version": "21.3", "versionType": "custom", "lessThanOrEqual": "21.22"}, {"status": "affected", "version": "23.4.0", "versionType": "custom", "lessThanOrEqual": "23.26.2"}]}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data."}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:database_-_java_vm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "19.31", "versionStartIncluding": "19.3"}, {"criteria": "cpe:2.3:a:oracle:database_-_java_vm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "21.22", "versionStartIncluding": "21.3"}, {"criteria": "cpe:2.3:a:oracle:database_-_java_vm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "23.26.2", "versionStartIncluding": "23.4.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-07-21T21:33:10.947Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47039", "state": "PUBLISHED", "dateUpdated": "2026-07-23T15:36:03.902Z", "dateReserved": "2026-05-18T15:55:10.318Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2026-07-21T21:33:10.947Z", "assignerShortName": "oracle"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Oracle Database Server", "vendor": "Oracle Corporation", "versions": [{"lessThanOrEqual": "19.31", "status": "affected", "version": "19.3", "versionType": "custom"}, {"lessThanOrEqual": "21.22", "status": "affected", "version": "21.3", "versionType": "custom"}, {"lessThanOrEqual": "23.26.2", "status": "affected", "version": "23.4.0", "versionType": "custom"}]}], "source": "secalert_us@oracle.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E3926BE-F763-4D59-9071-9DBC18E29F8F", "versionEndIncluding": "19.31", "versionStartIncluding": "19.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "9766EF97-7FDA-45A4-B271-48598FCCC365", "versionEndIncluding": "21.22", "versionStartIncluding": "21.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "F4751249-4629-4B55-B20C-65F443E83427", "versionEndIncluding": "23.26.2", "versionStartIncluding": "23.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el componente Java VM del servidor de base de datos Oracle. Versiones compatibles que est\u00e1n afectadas son 19.3-19.31, 21.3-21.22 y 23.4.0-23.26.2. Vulnerabilidad f\u00e1cilmente explotable permite a un atacante con pocos privilegios que tiene el privilegio Create Session con acceso de red a trav\u00e9s de Oracle Net comprometer Java VM. Ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n a datos cr\u00edticos o a todos los datos accesibles por Java VM. Puntuaci\u00f3n base CVSS 3.1 6.5 (Impactos en la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)."}], "id": "CVE-2026-47039", "lastModified": "2026-10-24T19:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "secalert_us@oracle.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47039", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T15:35:39.328841Z", "version": "2.0.3"}}]}, "published": "2026-07-21T22:17:09.547", "references": [{"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "https://www.oracle.com/security-alerts/cpujul2026.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.3,19.31]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[21.3,21.22]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.4.0,23.26.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Oracle Database Server", "source": "cna", "vendor": "Oracle Corporation"}, "product": "database_-_java_vm", "vendor": "oracle"}], "created": "2026-07-23T21:12:22.094501+00:00", "updated": "2026-08-03T00:00:04.662942+00:00", "vendors": ["oracle", "oracle$PRODUCT$database_-_java_vm"]}