CVE-2026-47039: Oracle Database Java VM Privilege Escalation

CVE-2026-47039 Overview

CVE-2026-47039 is a vulnerability in the Java VM component of Oracle Database Server. The flaw affects Oracle Database versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. A low-privileged attacker holding the Create Session privilege can exploit the vulnerability over Oracle Net to compromise the Java VM. Successful exploitation allows unauthorized creation, deletion, or modification of critical data or all Java VM accessible data. The weakness is classified under CWE-284: Improper Access Control. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
An authenticated remote attacker can modify or destroy data accessible to the Oracle Database Java VM without user interaction.

Affected Products

Oracle Database Server 19.3 through 19.31
Oracle Database Server 21.3 through 21.22
Oracle Database Server 23.4.0 through 23.26.2

Discovery Timeline

2026-07-21 - CVE-2026-47039 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47039

Vulnerability Analysis

The vulnerability resides in the Java VM component of Oracle Database Server. The Java VM executes Java stored procedures and code within the database engine. Improper access control in this component allows an authenticated database user to reach and manipulate data that the access control model should protect. The attack targets integrity, permitting unauthorized creation, deletion, or modification of Java VM accessible data. Confidentiality and availability are not directly affected according to Oracle's assessment.

Root Cause

The root cause maps to CWE-284: Improper Access Control. The Java VM component fails to enforce the access restrictions expected for a session-level user. A user with only the Create Session privilege gains the ability to perform integrity-impacting operations that should require higher authorization. The precise technical details have not been published by Oracle beyond the advisory summary.

Attack Vector

The attack is executed remotely over Oracle Net. The attacker authenticates to the database using any account holding the Create Session privilege. No user interaction is required, and the attack complexity is low. Once connected, the attacker issues operations that leverage the improper access control condition to modify data reachable by the Java VM. The vulnerability does not require administrative privileges, which broadens the exposure across shared or multi-tenant database environments.

Because no public exploit is available and Oracle has not released technical proof-of-concept details, exploitation code is not documented. Refer to the Oracle Critical Patch Update Advisory - July 2026 for vendor-provided details.

Detection Methods for CVE-2026-47039

Indicators of Compromise

Unexpected CREATE SESSION logons from accounts that historically do not connect over Oracle Net.
Anomalous invocations of Java stored procedures or PL/SQL wrappers around Java VM classes.
Unauthorized INSERT, UPDATE, or DELETE operations on tables reachable from the Java VM context.
Modifications to Java classes loaded in the database (DBA_JAVA_CLASSES, USER_JAVA_CLASSES) without a corresponding change ticket.

Detection Strategies

Enable Oracle Unified Auditing for Java VM operations and CREATE SESSION events, and forward audit records to a centralized analytics platform.
Baseline normal Java VM usage per account, then alert on deviations from that baseline, including new callers or new classes touched.
Correlate low-privileged session logons with subsequent write activity against sensitive schemas.

Monitoring Recommendations

Continuously monitor Oracle listener logs for connections originating from unexpected network segments.
Track privilege usage for accounts holding only CREATE SESSION and flag any use of Java VM procedures.
Ingest Oracle audit trails into a SIEM and build detection rules keyed to integrity-impacting operations against Java VM data.

How to Mitigate CVE-2026-47039

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Oracle Database Server instances.
Inventory database accounts holding the CREATE SESSION privilege and revoke it from accounts that do not require interactive access.
Restrict Oracle Net listener access to trusted application hosts using valid node checking or network ACLs.
Review recent Java VM activity for signs of unauthorized data modification prior to patching.

Patch Information

Oracle released fixes for CVE-2026-47039 in the Oracle Critical Patch Update - July 2026. Apply the update to bring Oracle Database Server 19c, 21c, and 23ai instances to a patched release above 19.31, 21.22, and 23.26.2 respectively.

Workarounds

If patching cannot occur immediately, remove the Java VM component from databases that do not require it using rmjvm.sql after validating application dependencies.
Enforce network segmentation so that only application tiers can reach the Oracle Net listener.
Rotate credentials for accounts with CREATE SESSION and enforce strong authentication for all database logons.

bash

# Identify accounts with CREATE SESSION and review Java VM usage
sqlplus / as sysdba <<'SQL'
SELECT grantee FROM dba_sys_privs WHERE privilege = 'CREATE SESSION';
SELECT owner, object_name, object_type
  FROM dba_objects
 WHERE object_type IN ('JAVA CLASS','JAVA SOURCE','JAVA RESOURCE');
SQL