CVE-2026-47060: Oracle Database JDBC Auth Bypass Flaw

CVE-2026-47060 Overview

CVE-2026-47060 is an access control weakness [CWE-284] in the Java Database Connectivity (JDBC) component of Oracle Database Server. An unauthenticated attacker with network access via Oracle Net can compromise JDBC when a legitimate user is convinced to interact with attacker-controlled input. Successful exploitation lets the attacker create, delete, or modify data reachable through JDBC without affecting confidentiality or availability.

The affected supported versions are 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Oracle addressed the issue in the Oracle Critical Patch Update Advisory of July 2026.

Critical Impact
Remote, unauthenticated attackers can tamper with all JDBC-accessible data when a user interacts with a crafted payload, resulting in high integrity impact to Oracle Database Server deployments.

Affected Products

Oracle Database Server JDBC component, versions 19.3 through 19.31
Oracle Database Server JDBC component, versions 21.3 through 21.22
Oracle Database Server JDBC component, versions 23.4.0 through 23.26.2

Discovery Timeline

2026-07-21 - CVE-2026-47060 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47060

Vulnerability Analysis

The vulnerability resides in the JDBC component of Oracle Database Server, which handles client connectivity from Java applications to the database engine over Oracle Net. Improper access control [CWE-284] allows a network-based attacker to influence JDBC operations without holding valid credentials. The attack requires human interaction, meaning a legitimate user must trigger the vulnerable code path by opening a connection, running an application, or processing attacker-supplied data.

The CVSS vector describes integrity-only impact, with no direct disclosure of data or denial of service. However, unauthorized creation, modification, or deletion of all JDBC-accessible data can cascade into application logic failures, corrupted business records, and downstream trust issues for anything relying on the database as a source of truth.

The EPSS score reported on 2026-07-23 is low, indicating limited observed exploitation activity at publication time. Oracle has not disclosed a public proof-of-concept, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper access control within the JDBC component, categorized under [CWE-284]. The component fails to adequately restrict who can perform certain operations against JDBC-managed data. Oracle's advisory does not publish the internal code path, but the CVSS metrics indicate the flaw is reachable over the network with low attack complexity and no privileges.

Attack Vector

The attack vector is Oracle Net, the network protocol Oracle Database uses for client-server communication. An attacker sends crafted traffic that is processed once a legitimate user performs a required action, such as launching a JDBC-enabled application or connecting to a hostile endpoint. Because no authentication is required, exposed database listeners and JDBC clients on untrusted networks broaden the attack surface.

No verified exploit code is publicly available. Refer to the Oracle Critical Patch Update Advisory of July 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-47060

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE statements originating from JDBC sessions that lack a matching authenticated application context.
Oracle Net connections from unusual source addresses immediately preceding data integrity anomalies.
Audit log entries showing schema or row-level changes without a corresponding authenticated user session.

Detection Strategies

Enable Oracle Database unified auditing for DML operations executed through JDBC drivers and correlate against expected application service accounts.
Compare JDBC client version and driver fingerprints against a known-good baseline to spot rogue or downgraded clients.
Monitor Oracle Net listener logs for connections that do not complete a full authenticated session yet trigger downstream data modification events.

Monitoring Recommendations

Forward Oracle audit logs and listener logs into a centralized SIEM with alerting on integrity-impacting SQL from unrecognized sources.
Track row-count deltas on business-critical tables to surface silent tampering that bypasses application layer logging.
Alert on outbound network egress from Java application servers to untrusted hosts that could deliver attacker-controlled JDBC input.

How to Mitigate CVE-2026-47060

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Database Server instances running affected 19c, 21c, or 23ai versions.
Restrict Oracle Net listener exposure to trusted management and application networks using firewall rules or Oracle Connection Manager.
Audit JDBC-enabled applications for connections that consume user-supplied hostnames, URLs, or connection strings.

Patch Information

Oracle released fixes as part of the Critical Patch Update on July 2026. Administrators should consult the Oracle Security Alert July 2026 for the exact patch bundle applicable to each supported release train (19.32+, 21.23+, and 23.27+ or the vendor-designated fixed builds).

Workarounds

Enforce VALID_NODE_CHECKING in sqlnet.ora to allow only approved client IP ranges to reach the database listener.
Require TLS-authenticated connections for all JDBC clients and disable legacy Oracle Net protocol options where possible.
Where patching is delayed, temporarily reduce user interaction risk by blocking end-user launched JDBC tooling against production databases and routing access through hardened middle-tier services.

bash

# Example sqlnet.ora hardening to limit exposure until patches are applied
tcp.validnode_checking = yes
tcp.invited_nodes = (10.10.20.15, 10.10.20.16, app-tier.internal)
tcp.excluded_nodes = (0.0.0.0/0)
SQLNET.ENCRYPTION_SERVER = required
SQLNET.CRYPTO_CHECKSUM_SERVER = required