SB2026012101 - Multiple vulnerabilities in Oracle Database Server
Published: January 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2025-61749)
The vulnerability allows a remote privileged user to manipulate data.
The vulnerability exists due to improper input validation within the Unified Audit in Oracle Database Server. A remote privileged user can exploit this vulnerability to manipulate data.
2) Improper input validation (CVE-ID: CVE-2025-53051)
The vulnerability allows a remote privileged user to gain access to sensitive information.
The vulnerability exists due to improper input validation within the RDBMS Functional Index in Oracle Database Server. A remote privileged user can exploit this vulnerability to gain access to sensitive information.
3) XML External Entity injection (CVE-ID: CVE-2025-4949)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.
Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.
4) Improper input validation (CVE-ID: CVE-2025-53047)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Portable Clusterware in Oracle Database Server. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
5) Improper input validation (CVE-ID: CVE-2025-61881)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Java VM in Oracle Database Server. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
6) Path traversal (CVE-ID: CVE-2025-4517)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to input validation error in the tarfile module when extracting files from an archive with filter="data". A remote attacker can pass specially crafted archive to the application and write files to arbitrary locations on the system outside the extraction directory.
Remediation
Install update from vendor's website.