Oracle Database Server (July 2026 CPU)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(330093);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/29");

  script_cve_id(
    "CVE-2026-46975",
    "CVE-2026-47038",
    "CVE-2026-47039",
    "CVE-2026-47040",
    "CVE-2026-47045",
    "CVE-2026-47046",
    "CVE-2026-47060",
    "CVE-2026-47061",
    "CVE-2026-60175",
    "CVE-2026-61211"
  );
  script_xref(name:"IAVA", value:"2026-A-0740");

  script_name(english:"Oracle Database Server (July 2026 CPU)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as
referenced in the July 2026 CPU advisory.

  - Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are
    19.3-19.31 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having
    Execute DBMS_CLOUD privilege with network access via Oracle Net to compromise RDBMS. While the
    vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful
    attacks of this vulnerability can result in takeover of RDBMS. (CVE-2026-61211)

  - Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are
    affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows
    unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful
    attacks of this vulnerability can result in unauthorized access to critical data or complete access to all
    Oracle Net Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash
    (complete DOS) of Oracle Net Services. (CVE-2026-47040)

  - Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are
    19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged
    attacker having Authenticated User privilege with network access via Oracle Net to compromise RDBMS.
    Successful attacks of this vulnerability can result in takeover of RDBMS. (CVE-2026-60175)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/docs/tech/security-alerts/cpujul2026csaf.json");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpujul2026.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the July 2026 Oracle Critical Patch Update advisory.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-47040");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-61211");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:database_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_rdbms_query_patch_info.nbin", "oracle_rdbms_patch_info.nbin");

  exit(0);
}

include('vcf_extras_oracle.inc');

var app_info = vcf::oracle_rdbms::get_app_info();

var constraints = [
  # RDBMS:
  {'min_version': '23.0', 'fixed_version': '23.26.3.0.0', 'missing_patch':'39578879', 'os':'unix', 'component':'db'},

  {'min_version': '21.0', 'fixed_version': '21.23.0.0.260721', 'missing_patch':'39549189', 'os':'unix', 'component':'db'},
  {'min_version': '21.0', 'fixed_version': '21.23.0.0.260721', 'missing_patch':'39300496', 'os':'win', 'component':'db'},

  {'min_version': '19.0', 'fixed_version': '19.32.0.0.260721', 'missing_patch':'39472050', 'os':'unix', 'component':'db'},
  {'min_version': '19.0', 'fixed_version': '19.32.0.0.260721', 'missing_patch':'39418910', 'os':'win', 'component':'db'},

  # OJVM:
  {'min_version': '19.0', 'fixed_version': '19.32.0.0.260721', 'missing_patch':'39222882', 'os':'win', 'component':'ojvm'},
  {'min_version': '19.0', 'fixed_version': '19.32.0.0.260721', 'missing_patch':'39222882', 'os':'unix', 'component':'ojvm'}

];

vcf::oracle_rdbms::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);