CVE-2026-46975 Overview
CVE-2026-46975 is a network-exploitable vulnerability in the Relational Database Management System (RDBMS) component of Oracle Database Server. The flaw allows an unauthenticated attacker with access to Oracle Net to compromise the RDBMS without user interaction. Successful exploitation results in unauthorized update, insert, or delete access to a subset of RDBMS-accessible data. Because the vulnerability produces a scope change, attacks can affect components beyond the vulnerable RDBMS itself. Oracle classifies the underlying weakness under CWE-284: Improper Access Control. Affected releases include Oracle Database 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2.
Critical Impact
Unauthenticated network attackers can modify data across Oracle Database deployments, undermining data integrity in RDBMS instances exposed over Oracle Net.
Affected Products
- Oracle Database Server RDBMS 19.3 through 19.31
- Oracle Database Server RDBMS 21.3 through 21.22
- Oracle Database Server RDBMS 23.4.0 through 23.26.2
Discovery Timeline
- 2026-07-21 - CVE-2026-46975 published to NVD as part of the Oracle Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-46975
Vulnerability Analysis
The vulnerability resides in the RDBMS component of Oracle Database Server and is reachable through the Oracle Net protocol. An attacker requires no credentials and no user interaction to exercise the flaw. Exploitation yields limited integrity impact, permitting unauthorized INSERT, UPDATE, or DELETE operations against a subset of database-accessible objects. Confidentiality and availability are not directly affected.
The advisory notes a scope change, meaning that a successful attack on the RDBMS can extend impact to additional Oracle products that trust or interoperate with the compromised database. This behavior is consistent with cross-component trust boundaries within the Oracle Database stack that share authentication or session context.
Root Cause
Oracle categorizes the defect under CWE-284 (Improper Access Control). The RDBMS component fails to enforce authorization checks on a code path reachable through Oracle Net listeners, allowing untrusted callers to invoke functionality that should require authenticated database sessions. Oracle has not publicly disclosed the specific subcomponent or PL/SQL surface involved beyond the Oracle Critical Patch Update July 2026.
Attack Vector
The attack vector is network-based over Oracle Net, typically TCP port 1521. An attacker who can reach the database listener sends crafted requests that trigger the vulnerable code path without supplying valid credentials. Because attack complexity is low and privileges are not required, exploitation is straightforward once network reachability is established. Refer to the Oracle Critical Patch Update advisory for vendor-published technical guidance.
Detection Methods for CVE-2026-46975
Indicators of Compromise
- Unexpected INSERT, UPDATE, or DELETE audit records originating from sessions without authenticated user context in DBA_AUDIT_TRAIL or unified audit views.
- Anomalous connections to the Oracle Net listener on TCP 1521 from hosts that do not normally interact with the database tier.
- Listener log entries showing repeated malformed or unusual service requests preceding integrity anomalies.
Detection Strategies
- Enable Oracle Unified Auditing and monitor DML operations executed outside of expected application service accounts.
- Correlate database listener logs with network flow data to identify unauthenticated sessions performing state-changing operations.
- Baseline row-modification volumes per schema and alert on deviations that align with the timing of unusual listener activity.
Monitoring Recommendations
- Ingest Oracle listener logs, unified audit logs, and network telemetry into a centralized analytics platform for cross-source correlation.
- Alert on Oracle Net connections from network segments that should not reach the database tier per firewall policy.
- Track patch level of every Oracle Database instance and flag hosts still running 19.3-19.31, 21.3-21.22, or 23.4.0-23.26.2.
How to Mitigate CVE-2026-46975
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all affected Oracle Database instances as soon as change windows permit.
- Inventory Oracle Database deployments and identify any instance running an affected 19.x, 21.x, or 23.x release.
- Restrict Oracle Net listener exposure to trusted application tiers using network segmentation and firewall rules.
Patch Information
Oracle addressed CVE-2026-46975 in the Oracle Critical Patch Update - July 2026. Administrators should apply the Release Update (RU) or Database Patch Set Update (PSU) that corresponds to their base version, following Oracle's documented patching procedures and post-patch validation steps.
Workarounds
- Configure Oracle Net VALID_NODE_CHECKING (tcp.validnode_checking=yes) with explicit tcp.invited_nodes allowlists to limit which hosts can reach the listener.
- Enforce TLS on Oracle Net and require client authentication where feasible to reduce exposure of the listener to untrusted callers.
- Place database servers behind dedicated firewalls and remove any direct exposure of TCP 1521 to untrusted networks until patches are applied.
# Example sqlnet.ora restrictions to limit listener exposure
# /u01/app/oracle/product/<version>/network/admin/sqlnet.ora
tcp.validnode_checking = yes
tcp.invited_nodes = (10.0.10.11, 10.0.10.12, 10.0.10.13)
tcp.excluded_nodes = (0.0.0.0/0)
# Reload the listener after changes
lsnrctl reload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
