PT-2026-3689 · Oracle · Oracle Database Server+1

Akira Hachiya · Publicado 2026-01-20 · Atualizado 2026-01-21 · CVE-2026-21939

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 23.4.0 through 23.26.0

Description A difficult-to-exploit issue exists within the SQLcl component that allows an unauthenticated attacker, with access to the infrastructure where SQLcl runs, to compromise SQLcl. Exploitation requires interaction from someone other than the attacker. Successful exploitation can lead to a takeover of SQLcl.

Recommendations Update to a version beyond 23.26.0.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2026-01004

CVE-2026-21939

Produtos afetados

Oracle Database Server

Sqlcl

Referências · 6

• https://twitter.com/CVEnew/status/2013783017706389849 · Publicação no Twitter
• https://oracle.com/security-alerts/cpujan2026.html · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2026012079 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-21939 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-01004 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-21939 · Aviso do Fabricante