CVE-2026-47061: Oracle Database JDBC Auth Bypass Flaw

CVE-2026-47061 Overview

CVE-2026-47061 affects the Java Database Connectivity (JDBC) component of Oracle Database Server. The flaw allows an unauthenticated attacker with adjacent network access to compromise the JDBC component when a user performs a specific action. Successful exploitation results in unauthorized access to critical data or complete access to all data reachable through JDBC. The vulnerability carries a scope change, meaning exploitation can affect components beyond JDBC itself. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
Successful exploitation exposes confidential data across systems reachable through the JDBC component, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Database Server JDBC, versions 19.3 through 19.31
Oracle Database Server JDBC, versions 21.3 through 21.22
Oracle Database Server JDBC, versions 23.4.0 through 23.26.2

Discovery Timeline

2026-07-21 - CVE-2026-47061 published to the National Vulnerability Database
2026-07-23 - CVE record last modified in the NVD database

Technical Details for CVE-2026-47061

Vulnerability Analysis

The vulnerability resides in the JDBC component of Oracle Database Server and is categorized under [CWE-284] Improper Access Control. An attacker must reside on the same physical communication segment as the hardware executing JDBC. Exploitation is difficult and requires interaction from a user other than the attacker. When conditions align, the attacker can read confidential data available to JDBC and pivot into other components because of the scope change property. The vulnerability affects only confidentiality; integrity and availability remain unaffected.

Root Cause

The root cause is improper access control within the JDBC component. The component does not adequately restrict access when an adjacent network attacker manipulates a session that a legitimate user initiates. Oracle has not published low-level technical detail beyond the advisory summary. Refer to the Oracle Security Alert July 2026 for authoritative details.

Attack Vector

The attack vector is Adjacent Network. The attacker must have access to the physical communication segment attached to the JDBC host, such as a shared broadcast domain, wireless network, or VLAN. The attacker cannot exploit the flaw remotely across the internet without adjacency. User interaction is required, so the attacker typically waits for or induces a legitimate JDBC connection or client action. Because scope changes upon success, downstream systems trusting the JDBC context may leak additional confidential data.

No public proof-of-concept exploit is available for CVE-2026-47061. The EPSS probability is 0.159%, indicating low near-term exploitation likelihood based on public signals. See the vendor advisory for technical guidance.

Detection Methods for CVE-2026-47061

Indicators of Compromise

Unexpected JDBC client sessions originating from hosts on the same broadcast domain or VLAN as the database server.
Anomalous read patterns against sensitive schemas immediately following a legitimate user connection.
ARP spoofing artifacts, duplicate MAC address alerts, or unexpected gratuitous ARP traffic near database subnets.

Detection Strategies

Correlate JDBC session establishment events with layer-2 anomalies such as ARP table changes on the database subnet.
Monitor Oracle audit logs for cross-schema access performed inside a session that initially targeted a single schema.
Alert on JDBC clients presenting mismatched hostname and IP metadata that could indicate session interposition.

Monitoring Recommendations

Enable Oracle Unified Auditing on JDBC-facing accounts and centralize logs in a SIEM for retention and correlation.
Deploy network detection controls that flag ARP spoofing, rogue DHCP, and layer-2 man-in-the-middle behavior on database segments.
Track patch level of Oracle Database Server against the July 2026 CPU across the estate and alert on drift.

How to Mitigate CVE-2026-47061

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Database Server installations running JDBC versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2.
Inventory JDBC clients and servers, prioritizing hosts on shared or untrusted layer-2 segments for immediate patching.
Restrict database network segments to trusted administrative VLANs and remove unnecessary hosts from those broadcast domains.

Patch Information

Oracle addressed CVE-2026-47061 in the July 2026 Critical Patch Update. Administrators should download and apply the patch bundle referenced in the Oracle Security Alert July 2026. Apply patches to all supported branches: 19.x, 21.x, and 23.x.

Workarounds

Enforce TLS for all JDBC connections using oracle.net.ssl_client_authentication and require server certificate validation to prevent adjacent-network interposition.
Segment database traffic onto dedicated VLANs with port security, DHCP snooping, and dynamic ARP inspection enabled.
Require VPN or IPsec tunnels for JDBC clients that cannot be placed on trusted physical segments.

bash

# Example: enforce TLS for Oracle JDBC clients (sqlnet.ora)
SQLNET.AUTHENTICATION_SERVICES=(TCPS)
SSL_CLIENT_AUTHENTICATION=TRUE
SSL_VERSION=1.2
WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/etc/oracle/wallet)))