Java VM Vulnerability in Oracle Database Server Affects Multiple Versions
CVE-2026-91615

6.3MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Database Server
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91615?

A security vulnerability exists in the Java VM component of Oracle Database Server, affecting several supported versions. This flaw allows a low privileged attacker, with network access via SOCKS5, to potentially exploit the Java VM. Successful exploitation can lead to unauthorized actions, such as the creation, deletion, or modification of sensitive data accessible to the Java VM. As a result, this vulnerability can extend its impact to additional products, increasing the importance of timely remediation.

Affected Version(s)

Oracle Database Server 19.3 <= 19.32

Oracle Database Server 21.3 <= 21.23

Oracle Database Server 23.4.0 <= 23.26.3

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.