VDB
CVE-2026-61211
CVE-2026-61211
PUBLISHED
CVSS 9.9 CRITICAL
Reported by oracle · Published July 21, 2026
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Execute DBMS_CLOUD privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Risk Scores
CVSS 3.1
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle Corporation | Oracle Database Server | 19.3, 23.4.0 |
| Oracle Corporation | Oracle Database Server | 23.4.0, 19.3, 23.4.0 |
| oracle | database_-_rdbms | 19.3, 23.4.0, 19.3 |
Timeline
- Jul 21, 2026 CVE Published
- Jul 22, 2026 Coalition ESS Score
- Jul 26, 2026 EPSS Score
- Aug 6, 2026 CVE Updated
References
- Oracle Advisory vendor-advisory