Introduction
An unauthenticated network vulnerability in Oracle Database Server's Java VM component lets remote attackers read critical data without any credentials or user interaction. It scores CVSS 7.5 on its confidentiality impact alone. Oracle holds the top position in global database management system rankings, with a score of 1157.93 on the DB Engines Ranking as of April 2026, so the potential blast radius of CVE-2026-35229 across enterprise environments is substantial.
Technical Information
CVE-2026-35229 is in the Java VM component of Oracle Database Server. Its CVSS 3.1 vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, tells us quite a bit about the nature and severity of the flaw.
The attack vector is the network (AV:N), so exploitation does not require local or physical access to the database server. Attack complexity is low (AC:L), which means triggering the vulnerability needs no specialized conditions or race conditions. Perhaps most important, the vulnerability requires no privileges (PR:N) and no user interaction (UI:N). An attacker needs only network connectivity to the Oracle Net listener to start the attack.
Scope is unchanged (S:U), so the exploited component and the impacted component are the same, and both are the Java VM. The confidentiality impact is rated high (C:H), which in CVSS terms means a total loss of confidentiality within the affected component. A successful exploit can give an attacker unauthorized access to critical data, or complete read access to all data the Java VM can access within the database. There is no impact on integrity (I:N) or availability (A:N), so this is purely a data disclosure vulnerability.
Attack Flow
The available technical details point to this general path for exploitation:
- The attacker identifies an Oracle Database Server instance with the Oracle Net listener accessible over the network.
- The attacker sends crafted requests over the Oracle Net protocol to the Java VM component.
- The attacker needs no authentication credentials at any stage of the attack.
- If the exploit succeeds, the attacker gains unauthorized read access to data the Java VM can access, which may include critical or sensitive database contents.
Because the vulnerability is reachable over the network, low in complexity, and needs no authentication, any attacker who can reach the Oracle Net listener can exploit it at scale.
Affected Versions
The vulnerability affects these supported versions of Oracle Database Server:
- Versions 19.3 through 19.30
- Versions 21.3 through 21.21
Both are long-term support release lines that are widely deployed in production enterprise environments.
Affected Systems and Versions
The following Oracle Database Server versions are confirmed vulnerable:
| Release Line | Affected Version Range |
|---|---|
| 19c | 19.3 through 19.30 |
| 21c | 21.3 through 21.21 |
Any deployment running these versions with the Java VM component enabled and Oracle Net accessible from untrusted networks is at risk. Java VM is an optional component in some configurations, so organizations should verify whether it is installed and active in their database instances.
Vendor Security History
Oracle's April 2026 Critical Patch Update contained 481 new security patches across its product portfolio, 8 of them for Oracle Database Products. That volume follows from how much software Oracle ships and how much ongoing work it takes to keep all of it secure.
Oracle has publicly acknowledged that it continues to receive reports of attackers compromising systems where customers failed to apply available patches. Delayed patching that leads to real-world compromise comes up again and again in Oracle's security advisories, and it is a strong reason to treat Critical Patch Updates as priority maintenance rather than discretionary work.
