This vulnerability in Oracle Database Server's RDBMS component allows an attacker with high privileges but no assigned privileges (None) and network access through Oracle Net to compromise the database by modifying accessible data via unauthorized update, insert, or delete operations. The affected versions are 19.3 to 19.31, 21.3 to 21.22, and 23.4.0 to 23.26.2. The CVSS 3.1 base score is 2.7, reflecting an integrity impact without confidentiality or availability impact. The vendor advisory references the July 2026 Critical Patch Update containing many patches but does not explicitly confirm a patch or remediation level for this vulnerability. Customers are advised to apply available patches promptly as a general best practice.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some data accessible through the Oracle Database Server RDBMS component. There is no impact on confidentiality or availability. The attacker requires high privileges but no specific privileges assigned and must have network access via Oracle Net. The overall impact is limited to integrity with a low severity rating.

The vendor advisory for the July 2026 Critical Patch Update does not explicitly confirm a patch or remediation level for CVE-2026-47038. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory content.