Loading vulnerability…
Unauthenticated data exposure and denial of service in Oracle Net Services Connection Manager
CVE-2026-47040 is an easily exploitable vulnerability in the Oracle Net Services component of Oracle Database Server, specifically identified as affecting Connection Manager. Supported affected versions are Oracle Database Server 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2. An unauthenticated attacker with network access via Oracle Net can exploit the flaw remotely without user interaction or credentials. Successful exploitation can compromise Oracle Net Services by exposing critical data accessible through the service and by causing the service to hang or crash repeatedly. The available information does not identify the precise vulnerable function or root cause, so a specific CWE cannot be assigned with confidence.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in unauthorized access to sensitive or critical data exposed through Oracle Net Services, potentially including complete access to all data reachable through the affected Oracle Net Services instance. The vulnerability also has a severe availability impact because an attacker can trigger hangs or frequently repeatable crashes, resulting in complete denial of service of Oracle Net Services. Reported scoring indicates high confidentiality and availability impact, with no confirmed integrity impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of Oracle Net Services and Connection Manager to untrusted networks by restricting network reachability to authorized hosts and administrative paths only. Disable or isolate unnecessary Oracle Net Services exposure where operationally feasible, place affected services behind network access controls, and monitor for abnormal connection activity or repeated service instability indicative of exploitation attempts. Because the vulnerability is unauthenticated and network-reachable, mitigation should focus on minimizing Oracle Net access until patches are applied.
Patch, then assume compromise.
Apply Oracle’s security update for CVE-2026-47040 and upgrade affected Oracle Database Server and Oracle Net Services deployments to vendor-fixed releases. Prioritize remediation for exposed Oracle Net Services and Connection Manager instances, especially internet-reachable or otherwise untrusted-network-accessible systems. Validate that all supported affected release lines, including 19c, 21c, and 23ai deployments within the listed vulnerable version ranges, are updated to patched versions provided by Oracle.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.