STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database default accounts must be assigned custom passwords.

DISA Rule

SV-270545r1064913_rule

Vulnerability Number

V-270545

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-011900

Severity

CAT I

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Change passwords for database management system (DBMS) accounts to nondefault values. Where necessary, unlock or enable accounts to change the password, and then return the account to disabled or locked status.

Check Contents

Use this query to identify the Oracle-supplied accounts that still have their default passwords:

SELECT * FROM SYS.DBA_USERS_WITH_DEFPWD;

If any accounts other than XS$NULL are listed, this is a finding.

XS$NULL is an internal account that represents the absence of a user in a session. Because XS$NULL is not a user, this account can only be accessed by the Oracle Database instance. XS$NULL has no privileges and no one can authenticate as XS$NULL, nor can authentication credentials ever be assigned to XS$NULL.

Vulnerability Number

V-270545

Documentable

False

Rule Version

O19C-00-011900

Severity Override Guidance

Use this query to identify the Oracle-supplied accounts that still have their default passwords:

SELECT * FROM SYS.DBA_USERS_WITH_DEFPWD;

If any accounts other than XS$NULL are listed, this is a finding.

XS$NULL is an internal account that represents the absence of a user in a session. Because XS$NULL is not a user, this account can only be accessed by the Oracle Database instance. XS$NULL has no privileges and no one can authenticate as XS$NULL, nor can authentication credentials ever be assigned to XS$NULL.

Check Content Reference

M

Target Key

5672