CVE-2026-47040 is a vulnerability in the Oracle Net Services component of Oracle Database Server that allows an unauthenticated attacker with network access via Oracle Net to compromise the service. Affected versions include 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Successful exploitation can lead to unauthorized access to critical data or a complete denial of service by causing hangs or crashes of Oracle Net Services. The vulnerability has a CVSS 3.1 base score of 9.1, reflecting high confidentiality and availability impacts. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle urges customers to remain on supported versions and apply security patches without delay.

This vulnerability allows unauthenticated attackers with network access to Oracle Net Services to gain unauthorized access to critical data or cause a complete denial of service by hanging or crashing the service. The impact affects confidentiality and availability, with no integrity impact noted. The CVSS score of 9.1 indicates a critical severity level. There are no known exploits in the wild at this time.

Oracle has released a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities including this one. However, the advisory does not explicitly confirm patch availability or remediation status specifically for CVE-2026-47040. Customers should consult the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability.