CVE-2026-91499

Vulnerability in the RDBMS component of Oracle Database Server affects versions 23.4.0-23.26.3. An easily exploitable flaw allows a low-privileged attacker with no special privileges and network access via HTTP to gain unauthorized access to critical data or complete access to all RDBMS data.

Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.

Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.

Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.

Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).

Vulnerability in the Java VM component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. A difficult to exploit flaw allows a low-privileged attacker with network access via SOCKS5 to perform unauthorized creation, deletion or modification of critical data.

Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. An easily exploitable Oracle Net attack allows a low-privileged attacker with Create Session privilege to gain unauthorized access to critical data, potentially impacting other products.

Vulnerability in the Oracle OLAP component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. An easily exploitable Oracle Net attack allows a low-privileged attacker with DBMS_AW privilege to take over Oracle OLAP.

Vulnerability in the VPD component of Oracle Database Server. A low privileged attacker with Create Table privilege can exploit it over the network via Oracle Net to gain unauthorized creation, deletion or modification access to VPD data. CVSS 8.1.

Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. An easily exploitable flaw allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running RDBMS to cause a hang or frequently repeatable crash (complete DOS).