PT-2026-3722 · Oracle · Oracle Database Server

CVE-2026-21975 · Publicado 2026-01-20 · Atualizado 2026-01-20

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.29 Oracle Database Server versions 21.3 through 21.20

Description An issue exists within the Java VM component of Oracle Database Server. A highly privileged attacker with Authenticated User privilege and network access via Oracle Net can compromise the Java VM. Exploitation requires human interaction from someone other than the attacker. Successful exploitation can lead to a denial-of-service condition, causing a hang or frequent crashes of the Java VM.

Recommendations Update Oracle Database Server to a version later than 19.29. Update Oracle Database Server to a version later than 21.20.

Correção

Improper Resource Release

RCE

Enumeração de Fraquezas

CWE-404

CWE-20

Identificadores relacionados

BDU:2026-01005

CVE-2026-21975

Produtos afetados

Oracle Database Server

Referências · 6

• https://oracle.com/security-alerts/cpujan2026.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-21975 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-01005 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2026012079 · Nota
• https://twitter.com/CVEnew/status/2013740409957085397 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-21975 · Nota de Segurança