Threats affecting pkg:maven/com.oracle/database-server

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Net Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

CVE-2026-60175 is a high-severity vulnerability in the Oracle Database Server RDBMS component affecting versions 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2. It allows a low privileged attacker with authenticated user access and network connectivity via Oracle Net to compromise the database server. Successful exploitation can lead to full takeover of the RDBMS, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.8. Oracle has released a Critical Patch Update advisory addressing this and many other vulnerabilities, recommending prompt patching.

Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Net Service. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. While the vulnerability is in Net Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Net Service. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-34312 is a low-severity vulnerability in Oracle Database Server versions 19.3 to 19.30. It allows a high privileged attacker with Row Access Method privilege and network access via multiple protocols to gain unauthorized read access to a subset of database data. Exploitation requires human interaction from a user other than the attacker. The vulnerability impacts confidentiality but does not affect integrity or availability. Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory but has not explicitly confirmed patch availability or remediation status for this specific issue. Customers are strongly advised to apply Oracle Critical Patch Updates promptly to mitigate such vulnerabilities.

CVE-2026-21999 is a vulnerability in the XML Database component of Oracle Database Server versions 23.4.0 through 23.26.1. It allows an unauthenticated attacker with network access via HTTPS to potentially gain unauthorized access to critical data in the XML Database. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 5.