CVE-2026-47060

{
  "id": "CVE-2026-47060",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:17:11.850",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the JDBC component of Oracle Database Server.  Supported versions that are affected are 19.3-19.31, 21.3-21.22 and  23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JDBC.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JDBC accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el componente JDBC de Servidor de base de datos Oracle. Las versiones compatibles que están afectadas son 19.3-19.31, 21.3-21.22 y 23.4.0-23.26.2. La vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red a través de Oracle Net comprometer JDBC. Los ataques exitosos requieren interacción humana de una persona que no sea el atacante. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de creación, eliminación o modificación a datos críticos o a todos los datos accesibles por JDBC. Puntuación Base CVSS 3.1 de 6.5 (Impactos en la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Database Server",
          "versions": [
            {
              "version": "19.3",
              "lessThanOrEqual": "19.31",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "21.3",
              "lessThanOrEqual": "21.22",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "23.4.0",
              "lessThanOrEqual": "23.26.2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T16:13:33.514973Z",
          "id": "CVE-2026-47060",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "19.3",
              "versionEndIncluding": "19.31",
              "matchCriteriaId": "6E3926BE-F763-4D59-9071-9DBC18E29F8F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "21.3",
              "versionEndIncluding": "21.22",
              "matchCriteriaId": "9766EF97-7FDA-45A4-B271-48598FCCC365"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "23.4",
              "versionEndIncluding": "23.26.2",
              "matchCriteriaId": "F4751249-4629-4B55-B20C-65F443E83427"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}