CVE-2026-46975 is a medium severity vulnerability in Oracle Database Server's RDBMS component that allows unauthenticated network attackers to perform unauthorized update, insert, or delete operations on database data via Oracle Net. The affected versions include 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. The vulnerability impacts data integrity but does not affect confidentiality or availability. The vulnerability's scope may extend beyond the RDBMS to other Oracle products. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among 1449 patches but does not provide explicit patch details for this specific CVE in the provided content. Customers are urged to apply the Critical Patch Update promptly to mitigate this and other vulnerabilities.

Successful exploitation of CVE-2026-46975 can result in unauthorized modification of data (update, insert, delete) accessible via the Oracle Database Server RDBMS component. The vulnerability does not impact confidentiality or availability but compromises data integrity. The attack requires network access via Oracle Net and does not require authentication, increasing the risk of exploitation. The vulnerability may also affect other Oracle products due to scope change, potentially broadening the impact.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses this vulnerability among many others. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since no explicit patch details for this CVE are provided in the advisory content, users must consult the vendor advisory and patch availability documentation for their specific Oracle Database Server versions. Maintaining up-to-date patches is the primary mitigation. No alternative or temporary mitigations are indicated.