CVE-2026-47040

{
  "id": "CVE-2026-47040",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:17:09.667",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Net Services component of Oracle Database Server.  Supported versions that are affected are 19.3-19.31, 21.3-21.22 and  23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Net Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el componente Oracle Net Services de Oracle Database Server. Versiones compatibles que están afectadas son 19.3-19.31, 21.3-21.22 y 23.4.0-23.26.2. Vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso de red a través de Oracle Net comprometer Oracle Net Services. Ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a datos críticos o acceso completo a todos los datos accesibles de Oracle Net Services y capacidad no autorizada de causar un cuelgue o una caída frecuentemente repetible (DoS completo) de Oracle Net Services. Puntuación Base CVSS 3.1 de 9.1 (Impactos en Confidencialidad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Net Services",
          "versions": [
            {
              "version": "19.3",
              "lessThanOrEqual": "19.31",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "21.3",
              "lessThanOrEqual": "21.22",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "23.4.0",
              "lessThanOrEqual": "23.26.2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T15:36:36.852864Z",
          "id": "CVE-2026-47040",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "19.3",
              "versionEndIncluding": "19.31",
              "matchCriteriaId": "6E3926BE-F763-4D59-9071-9DBC18E29F8F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "21.3",
              "versionEndIncluding": "21.22",
              "matchCriteriaId": "9766EF97-7FDA-45A4-B271-48598FCCC365"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "23.4",
              "versionEndIncluding": "23.26.2",
              "matchCriteriaId": "F4751249-4629-4B55-B20C-65F443E83427"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}