Oracle Database July 2026 Critical Patch Update (CPU): Oracle Net Services Exposure & RDBMS Privilege Escalation

Executive Summary: Database Security Focus (July 2026 CPU)

racle’s July 2026 Critical Patch Update (CPU) contains high-severity security vulnerabilities impacting core database engine components, specifically Oracle Net Services and the RDBMS engine.

---

Key Database Vulnerabilities Disclosed

1. Oracle Net Services Unauthenticated Exposure & DOS (CVE-2026-47040, CVSS 9.1)

• The Threat: An easily exploitable vulnerability allows an unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks result in unauthorized access to critical data or complete access to all Oracle Net Services accessible data, and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS).
• Affected Versions: Oracle Database versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2.

2. RDBMS Privilege Escalation to Takeover (CVE-2026-60175, CVSS 8.8)

• The Threat: An easily exploitable vulnerability allows a low-privileged attacker (with Authenticated User privilege) with network access via Oracle Net to compromise the RDBMS. Successful attacks can result in the complete takeover of the RDBMS engine.
• Affected Versions: Oracle Database versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2.

---

🔍 Check Your Database Environment Now (Diagnostic CTA)

Run the following OPatch CLI command and SQL query right now to verify if your database host has applied the July 2026 patch:

# Diagnostic 1: Check Current Database Patch Inventory via OPatch
$ORACLE_HOME/OPatch/opatch lsinventory | grep -E "Patch description|Applied on"

-- Diagnostic 2: Query Applied Database Release Updates
SELECT 
    action_time, 
    action, 
    status, 
    description, 
    version 
FROM dba_registry_sqlpatch
ORDER BY action_time DESC;

Action Criteria:

• Oracle Database 19c / 21c / 23ai: Verify that the July 2026 Release Update (or appropriate overlay patch for your release level) is listed in dba_registry_sqlpatch.
• Network Defense: Ensure TNS Listener / Oracle Net ports (default 1521) are protected via network firewalls and sqlnet.ora (TCP.VALIDNODE_CHECKING = YES).

---

Recommended Patching & Isolation Workflow

1. Apply Release Update: Run $ORACLE_HOME/OPatch/opatchauto apply for rolling RAC / Data Guard patching.
2. Network Isolation: Update sqlnet.ora to restrict client IP connections to authorized app servers and management hosts:

# Enforce Network ACL in sqlnet.ora
TCP.VALIDNODE_CHECKING = YES
TCP.INVITED_NODES = (192.168.10.10, 192.168.10.11, 10.0.5.*)

📚 Official Documentation & Technical References

• Oracle Critical Patch Update Advisory - July 2026
• Text Form of Oracle CPU July 2026 Risk Matrices

---

Need assistance auditing or patching Oracle 19c, 21c, or 23ai databases? Download our RMAN & Database Runbooks or Schedule an Emergency Database Audit.