Critical severity9.8NVD Advisory· Published Oct 17, 2018· Updated Jun 17, 2026

CVE-2018-3259

Description

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products

Oracle Corporation/Java VMllm-fuzzy
Range: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
Oracle Corporation/Database Serverllm-fuzzy
Range: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
Oracle Corporation/Database Corecpe-rescue
Range: 11.2.0.4

Patches

Vulnerability mechanics

References

www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlnvdPatchVendor Advisory
www.securityfocus.com/bid/105648nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1041890nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000