PT-2026-36964 · Oracle · Mcp Server Helper Tool

Published 2026-05-05 · Updated 2026-06-10 · CVE-2026-35228

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Oracle MCP Server Helper Tool versions 1.0.1 through 1.0.156

Description An unauthenticated attacker with network access via HTTP can compromise the Oracle MCP Server Helper Tool. This issue allows the execution of malicious SQL, a technique known as SQL Injection, where an attacker interferes with the queries that an application makes to its database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-35228

Affected Products

Mcp Server Helper Tool

References · 9

• https://oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35228 · Security Note
• https://t.me/CVEtracker/52705 · Telegram Post
• https://twitter.com/CVEarity/status/2051609430555541790 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051587963130167431 · Twitter Post
• https://twitter.com/Tank23x0/status/2064815617975464318 · Twitter Post
• https://t.me/cveNotify/162172 · Telegram Post
• https://t.me/cveNotify/162130 · Telegram Post
• https://twitter.com/teambi0s/status/2060786741804711939 · Twitter Post