Oracle Database Server Java VM Vulnerability Allows Unauthenticated Data Access and Modification

A vulnerability has been identified in the Java VM component of Oracle Database Server. This issue affects versions 19.3-19.26, 21.3-21.17, and 23.4-23.7. The vulnerability, which is difficult to exploit, allows an unauthenticated attacker with network access to compromise the Java VM. Successful exploitation could lead to unauthorized creation, deletion, or modification of critical data, or any data accessible to the Java VM.

Impact

Exploitation of this vulnerability could result in unauthorized access to, and modification of, critical data or any data accessible to the Java VM.

Remediation

Users can apply the latest security patches available through the Oracle Critical Patch Update program. Instructions for applying these patches can be found in the Oracle Database April 2025 Critical Patch Update Patch Availability Document.