PT-2026-3689 · Oracle · Oracle Database Server+1

Akira Hachiya · Published 2026-01-20 · Updated 2026-01-21 · CVE-2026-21939

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 23.4.0 through 23.26.0

Description A difficult-to-exploit issue exists within the SQLcl component that allows an unauthenticated attacker, with access to the infrastructure where SQLcl runs, to compromise SQLcl. Exploitation requires interaction from someone other than the attacker. Successful exploitation can lead to a takeover of SQLcl.

Recommendations Update to a version beyond 23.26.0.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-01004

CVE-2026-21939

Affected Products

Oracle Database Server

Sqlcl

References · 6

• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21939 · Security Note
• https://bdu.fstec.ru/vul/2026-01004 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21939 · Vendor Advisory
• https://twitter.com/CVEnew/status/2013783017706389849 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2026012079 · Note