PT-2026-34147 · Oracle · Oracle Database Server+1

Published 2026-04-21 · Updated 2026-05-20 · CVE-2026-35229

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.30 Oracle Database Server versions 21.3 through 21.21

Description An issue exists in the Java VM component of Oracle Database Server. An unauthenticated attacker with network access via Oracle Net can exploit this flaw to compromise the Java VM. Successful exploitation may lead to unauthorized access to critical data or complete access to all data accessible by the Java VM.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-35229

Affected Products

Oracle Database Server

Java Virtual Machine

References · 5

• https://oracle.com/security-alerts/cpuapr2026.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35229 · Security Note
• https://twitter.com/CVEnew/status/2048546619067674803 · Twitter Post
• https://twitter.com/ORADBAONLINE/status/2057148605329219988 · Twitter Post
• https://t.me/cveNotify/162209 · Telegram Post