/
← Voltar ao feed
high

CERT-FR flags multiple Oracle Database Server vulnerabilities, including remote code execution, in the October 2026 CPU

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 1 dia

CERT-FR advisory CERTFR-2026-AVI-1349 reports multiple vulnerabilities in Oracle Database Server and related components, fixed in the Oracle Critical Patch Update cpuoct2026 of 20 October 2026. According to the advisory, some of the flaws allow an attacker to achieve remote arbitrary code execution, remote denial of service and breach of data confidentiality. The advisory also lists data integrity violation and security policy bypass as possible impacts. It does not mention active exploitation, IOCs or attribution.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1349 covers 46 CVEs (including CVE-2025-27820 and CVE-2026-101510 through CVE-2026-93579) in Oracle Database Server, Oracle Net Services, Oracle OLAP and Oracle SQLcl, versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Some flaws allow remote arbitrary code execution, remote denial of service and loss of data confidentiality; data integrity violation and security policy bypass are also listed. The advisory does not map impacts to CVEs, nor give CVSS scores, attack vectors or prerequisites. Fixes are in Oracle's cpuoct2026 Critical Patch Update of 20 October 2026.

Como foi descoberta

The advisory only says that multiple vulnerabilities were discovered in Oracle Database Server and that they were fixed in Oracle's cpuoct2026 bulletin of 20 October 2026; CERT-FR published its notice on 21 October 2026. It does not say who found the flaws or how, and it does not mention active exploitation, IOCs or attribution.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:23.

Detalhes técnicos

  • Affected: Oracle Database Server, Oracle Net Services, Oracle OLAP and Oracle SQLcl, in versions 19.3 to 19.32, 21.3 to 21.23 and 23.4.0 to 23.26.3.
  • 46 CVEs are referenced, including CVE-2025-27820 and CVE-2026-101510 through CVE-2026-93579.
  • The advisory does not map impacts to individual CVEs, nor does it give CVSS scores or attack vectors.

Remediação

  • Consult the Oracle security bulletin cpuoct2026 (20 October 2026) to obtain the patches and apply them to all affected Database Server, Net Services, OLAP and SQLcl installations.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 22/10 13:01 primeiro registro

    CERT-FR flags multiple Oracle Database Server vulnerabilities, including remote code execution, in the October 2026 CPU

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1349 reports multiple vulnerabilities in Oracle Database Server and related components, fixed in the Oracle Critical Patch Update cpuoct2026 of 20 October 2026. According to the advisory, some of the flaws allow an attacker to achieve remote arbitrary code execution, remote denial of service and breach of data confidentiality. The advisory also lists data integrity violation and security policy bypass as possible impacts. It does not mention active exploitation, IOCs or attribution.

    Technical Details

    • Affected: Oracle Database Server, Oracle Net Services, Oracle OLAP and Oracle SQLcl, in versions 19.3 to 19.32, 21.3 to 21.23 and 23.4.0 to 23.26.3.
    • 46 CVEs are referenced, including CVE-2025-27820 and CVE-2026-101510 through CVE-2026-93579.
    • The advisory does not map impacts to individual CVEs, nor does it give CVSS scores or attack vectors.

    Remediation

    • Consult the Oracle security bulletin cpuoct2026 (20 October 2026) to obtain the patches and apply them to all affected Database Server, Net Services, OLAP and SQLcl installations.