This vulnerability in Oracle Database Server's RDBMS component (versions >=23.4.0 <=23.26.3) allows an attacker with low privileges and authenticated network access via Oracle Net to compromise the database server. The vulnerability has a scope change, meaning it may affect additional Oracle products beyond the RDBMS itself. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability along with 942 others across multiple Oracle product families.

Successful exploitation can result in complete takeover of the Oracle RDBMS, leading to full compromise of confidentiality, integrity, and availability of the database. The vulnerability's scope change means that additional Oracle products relying on the RDBMS may also be significantly impacted. The CVSS score of 8.5 reflects a high severity threat with potential critical consequences for affected systems.

Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle emphasizes remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.