CVE-2026-60175: Oracle Database Privilege Escalation Flaw

CVE-2026-60175 Overview

CVE-2026-60175 is a high-severity vulnerability in the Relational Database Management System (RDBMS) component of Oracle Database Server. An authenticated attacker with low privileges can exploit the flaw over Oracle Net to compromise the database. Successful exploitation results in full takeover of the RDBMS, impacting confidentiality, integrity, and availability. The weakness is categorized under [CWE-269] Improper Privilege Management, indicating that authenticated sessions can gain rights beyond their intended scope. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
A low-privileged authenticated user with network access via Oracle Net can achieve full takeover of the Oracle RDBMS.

Affected Products

Oracle Database Server RDBMS versions 19.3 through 19.31
Oracle Database Server RDBMS versions 21.3 through 21.22
Oracle Database Server RDBMS versions 23.4.0 through 23.26.2

Discovery Timeline

2026-07-21 - CVE-2026-60175 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60175

Vulnerability Analysis

The vulnerability resides in the Oracle Database RDBMS component and is reachable over Oracle Net, the network protocol used by clients to communicate with database instances. An attacker only requires a valid low-privileged database account to exploit the flaw. The advisory describes the issue as easily exploitable, with impact spanning confidentiality, integrity, and availability. The EPSS model currently estimates a 0.447% probability of exploitation within 30 days.

Root Cause

The issue maps to [CWE-269] Improper Privilege Management. Logic within the RDBMS fails to enforce privilege boundaries for authenticated sessions, allowing an attacker to perform actions reserved for higher-privileged roles. Oracle has not published component-level technical detail beyond the July 2026 Critical Patch Update advisory.

Attack Vector

Exploitation requires network reachability to the Oracle Net listener and a functioning database account. No user interaction is required, and the attack complexity is low. Once authenticated, the attacker sends crafted requests to the RDBMS component to escalate privileges and take control of database operations, data, and stored objects.

No public proof-of-concept code has been released. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60175

Indicators of Compromise

Unexpected GRANT, ALTER USER, or role modification statements executed by low-privileged accounts.
Sessions from standard user accounts invoking SYS-owned procedures or accessing DBA_* views.
Unusual connections to the Oracle Net listener from hosts outside normal application tiers.

Detection Strategies

Enable Oracle Unified Audit and monitor privilege-use audit trails for anomalous escalation events.
Correlate database audit logs with network telemetry to identify Oracle Net sessions performing administrative actions from non-admin accounts.
Baseline SQL activity per application account and alert on deviations such as data dictionary reads or DDL execution.

Monitoring Recommendations

Forward Oracle audit records and listener logs to a centralized SIEM for correlation and long-term retention.
Track failed and successful logons across all database accounts, prioritizing service and shared accounts.
Alert on execution of privileged packages such as DBMS_SYS_SQL or DBMS_JAVA from unexpected sessions.

How to Mitigate CVE-2026-60175

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Oracle Database Server instances.
Inventory Oracle Database deployments and confirm versions against the affected ranges: 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2.
Rotate credentials for database accounts that are exposed to untrusted networks or shared across applications.
Restrict Oracle Net listener exposure to trusted application subnets using firewall rules and VALID_NODE_CHECKING_REGISTRATION.

Patch Information

Oracle addresses CVE-2026-60175 in the July 2026 Critical Patch Update. Administrators should download the applicable Release Update or Patch Set Update for their supported release from My Oracle Support and apply it per the deployment guidance in the Oracle Security Alert July 2026.

Workarounds

Enforce least privilege by revoking unnecessary system and object privileges from application accounts.
Restrict Oracle Net access with network ACLs, sqlnet.oraTCP.INVITED_NODES, or a database firewall until patching is complete.
Enable Oracle Database Vault or equivalent controls to segregate duties for privileged operations where supported.

bash

# Restrict Oracle Net listener to trusted hosts (sqlnet.ora)
tcp.validnode_checking = yes
tcp.invited_nodes = (10.10.20.11, 10.10.20.12, 10.10.20.13)
tcp.excluded_nodes = (0.0.0.0/0)