Security readout for executives and security teams
Plain-English summary
This is a high-severity Oracle Database Scheduler vulnerability. A low-privileged user who can log on locally to the infrastructure where Scheduler runs could take over Scheduler, with high confidentiality, integrity, and availability impact. The risk is most urgent for Oracle Database environments that allow broad local access to database hosts.
Executive priority
Prioritize this for Oracle Database systems supporting sensitive or business-critical workloads, especially where many users or service accounts can log on locally. Treat as a high internal compromise risk, not as a confirmed internet-wide exploitation event.
Technical view
CVE-2020-14735 affects Oracle Database Server Scheduler in Enterprise Edition versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c. CVSS 3.1 is 8.8: local attack vector, low complexity, low privileges, no user interaction, changed scope, and high CIA impact.
Likely exposure
Exposure is limited to affected Oracle Database Enterprise Edition deployments where an attacker already has local logon privilege to the infrastructure where Scheduler executes. Internet-only attackers are not indicated by the provided CVSS vector.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. The vulnerability is described as easily exploitable after local logon, so internal users, compromised host accounts, or lateral movement scenarios matter most.
Researcher notes
Key constraints are AV:L and PR:L. Validation should focus on affected Oracle versions, Scheduler exposure, local account paths, and patch state. The provided sources do not include CWE mapping, exploit evidence, or detailed mitigation beyond Oracle CPU guidance.
Mitigation direction
- Identify Oracle Database Enterprise Edition versions in the affected list.
- Review Oracle's October 2020 Critical Patch Update guidance for this CVE.
- Apply the relevant Oracle-supported CPU or later cumulative database patch.
- Restrict local logon access where Oracle Scheduler executes.
- Monitor Scheduler activity and privileged local accounts for unexpected changes.
Validation and detection
- Inventory Oracle Database editions and versions against the affected list.
- Confirm patch level includes Oracle's applicable October 2020 CPU fix or later guidance.
- Review local account access to database hosts or Scheduler infrastructure.
- Check audit logs for unusual Scheduler jobs, ownership changes, or privilege changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-14735 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuoct2020.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.