This vulnerability (CVE-2026-47039) affects the Java VM component within Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. It permits a low privileged attacker who has the Create Session privilege and network access via Oracle Net to compromise the Java VM. The compromise can result in unauthorized creation, deletion, or modification of critical data or any data accessible by the Java VM. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Oracle’s July 2026 Critical Patch Update advisory mentions this vulnerability among many others but does not explicitly state the patch status for this vulnerability in the provided excerpt.

The impact of this vulnerability is unauthorized modification of critical data or all data accessible to the Java VM within the Oracle Database Server. There is no confidentiality or availability impact reported. The attacker requires only low privileges (Create Session) and network access, making it relatively easy to exploit. The integrity of the database can be compromised, potentially affecting data trustworthiness and application behavior relying on Java VM data.

Oracle’s July 2026 Critical Patch Update advisory includes this vulnerability among many others. However, the advisory content provided does not explicitly confirm the availability of a patch or official remediation for CVE-2026-47039. Customers are strongly recommended to remain on actively supported versions and apply Oracle Critical Patch Updates promptly once available. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance and patch availability.