CVE-2026-23927 — Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server an…
Published: 2026-05-06 · CVSS: 5.1 · CVSS 4.0
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7