This vulnerability in Oracle Database Server's JDBC component affects multiple supported versions (19.3-19.31, 21.3-21.22, 23.4.0-23.26.2). It allows an attacker with high privileges but no direct privileges on the target system, who has network access via Oracle Net, to compromise the JDBC component. The attack requires user interaction from a third party. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, user interaction needed, unchanged scope, and high impact on confidentiality, integrity, and availability. No known exploits in the wild are reported. The vendor advisory from Oracle does not explicitly confirm patch availability or remediation level for this specific vulnerability but recommends applying Critical Patch Updates promptly.

Successful exploitation can result in complete compromise of the JDBC component within Oracle Database Server, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over JDBC operations, potentially leading to unauthorized data access or disruption of database services.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities including this one. However, the vendor advisory does not explicitly confirm a specific patch or remediation level for CVE-2026-47045. Customers should review the Oracle Critical Patch Update documentation and apply relevant patches for affected Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2 as soon as they become available. Until patched, limit network exposure of Oracle Net services and ensure that users are aware of social engineering risks since exploitation requires user interaction.