This vulnerability exists in the JDBC component of Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. It requires an attacker to have physical access to the communication segment attached to the hardware where JDBC executes and also requires human interaction from a person other than the attacker. The vulnerability allows unauthorized access to critical data or complete access to all data accessible via JDBC. The CVSS vector indicates the attack vector is adjacent network (AV:A), with high attack complexity (AC:H), no privileges required (PR:N), and requires user interaction (UI:R). The scope is changed (S:C), confidentiality impact is high (C:H), and there is no impact on integrity or availability. Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities but does not explicitly confirm a patch for this specific CVE in the provided advisory content.

Successful exploitation can result in unauthorized access to critical data or complete access to all JDBC-accessible data. The confidentiality of data is significantly impacted. There is no reported impact on data integrity or availability. The attack requires physical access to the communication segment and human interaction, making exploitation difficult.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant Critical Patch Updates promptly to mitigate vulnerabilities. Until an official patch is confirmed and applied, restrict physical access to hardware communication segments where JDBC executes and limit opportunities for required human interaction.