PT-2026-3722 · Oracle · Oracle Database Server

Published 2026-01-20 · Updated 2026-01-20 · CVE-2026-21975

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.29 Oracle Database Server versions 21.3 through 21.20

Description An issue exists within the Java VM component of Oracle Database Server. A highly privileged attacker with Authenticated User privilege and network access via Oracle Net can compromise the Java VM. Exploitation requires human interaction from someone other than the attacker. Successful exploitation can lead to a denial-of-service condition, causing a hang or frequent crashes of the Java VM.

Recommendations Update Oracle Database Server to a version later than 19.29. Update Oracle Database Server to a version later than 21.20.

Fix

Improper Resource Release

RCE

Weakness Enumeration

CWE-404

CWE-20

Related Identifiers

BDU:2026-01005

CVE-2026-21975

Affected Products

Oracle Database Server

References · 6

• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21975 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01005 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21975 · Security Note
• https://cybersecurity-help.cz/vdb/SB2026012079 · Note
• https://twitter.com/CVEnew/status/2013740409957085397 · Twitter Post