This vulnerability in Oracle Database Server's JDBC component enables an unauthenticated network attacker to compromise JDBC access via Oracle Net. Exploitation requires user interaction from a third party. The impact is unauthorized modification of data accessible through JDBC. Affected versions include 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates network attack vector, low attack complexity, no privileges required, required user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) references this vulnerability but does not explicitly state patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches promptly, but patch status for this vulnerability is not explicitly confirmed in the advisory.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible via JDBC. The integrity of the database is at risk, but confidentiality and availability are not impacted according to the CVSS vector. The vulnerability requires user interaction from a person other than the attacker, which may limit exploitation scenarios. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends remaining on actively supported versions and applying security patches without delay. Since the advisory does not explicitly confirm a patch or temporary fix for this vulnerability, organizations should monitor Oracle's updates closely and apply any relevant patches as soon as they become available. Until patched, limit exposure of Oracle Net interfaces and consider restricting network access to trusted users to reduce risk.