This vulnerability in Oracle Database Server's RDBMS component allows an unauthenticated network attacker to exploit Oracle Net to compromise the database. Exploitation can lead to a complete denial of service by causing the database to hang or crash repeatedly, as well as unauthorized modification of some accessible data through update, insert, or delete operations. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and affects integrity and availability without impacting confidentiality. Affected versions explicitly include 23.4.0 and up to 23.26.2. Oracle's July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a fix for this CVE, and no patch links are provided in the data. The vendor strongly recommends applying patches promptly once available and staying on supported versions.

Successful exploitation can cause a complete denial of service of the Oracle Database Server by hanging or crashing it repeatedly. Additionally, it allows unauthorized modification of some accessible data (update, insert, delete) without authentication. Confidentiality is not impacted according to the CVSS vector. The vulnerability thus impacts data integrity and system availability significantly.

Oracle's July 2026 Critical Patch Update advisory includes numerous patches for multiple vulnerabilities but does not explicitly confirm a patch for CVE-2026-47046. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay once they become available. Until a patch is confirmed, monitor Oracle advisories closely and restrict network access to Oracle Net interfaces where possible.