SQLcl Auth0 Vulnerability 23.4.0-23.26.0 Oracle DB Server
CVE-2026-21939 Published on January 20, 2026

Vulnerability in the SQLcl component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where SQLcl executes to compromise SQLcl. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of SQLcl. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-21939 can be exploited with local system access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Products Associated with CVE-2026-21939

stack.watch emails you whenever new vulnerabilities are published in Oracle or Oracle Database Sqlcl. Just hit a watch button to start following.

Oracle
 
Oracle Database Sqlcl
 

Affected Versions

Oracle Corporation Oracle Database Server:

Exploit Probability

EPSS
0.04%
Percentile
10.51%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.