CVE-2026-101510 in Oracle
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows high privileged attacker having None privilege with logon to the infrastructure where Oracle Net Services executes to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle Net Services component of the Oracle Database Server, affecting supported versions including releases from the 19.x series ranging from 19.3 to 19.32, as well as the 21.x series from 21.3 to 21.23, and specific builds within the 23c architecture spanning from 23.4.0 to 23.26.3. This component is critical for managing network communication between clients and database instances, making its stability paramount for enterprise operations. The flaw represents a significant risk to system availability due to its potential to trigger complete denial of service conditions through repeatable crashes or hangs within the Net Services layer itself.
From a technical perspective, this vulnerability allows an attacker with high privileges but no additional authentication requirements beyond logon access to the infrastructure hosting Oracle Net Services to exploit the flaw. The exploitation vector is classified as local network-based, requiring low attack complexity and user interaction is not necessary for successful execution. Once triggered, the defect leads to unauthorized ability to cause a hang or frequently repeatable crash of the Oracle Net Services process. This results in a complete denial of service where legitimate users are unable to establish connections to the database server until the affected component is restarted by an administrator. The impact is strictly on availability, with no direct compromise of confidentiality or integrity data states implied by this specific vector.
The operational impact of such a vulnerability extends beyond simple downtime for individual sessions. In enterprise environments, Oracle Net Services acts as the primary interface for client connectivity; therefore, its failure can isolate entire database instances from their application layers. This disruption affects business continuity and service level agreements dependent on real-time data access. The ability to cause repeatable crashes means that an attacker could sustain a denial of service condition with minimal effort after initial exploitation, potentially requiring repeated attacks or maintaining persistent access to keep the services unstable.
In terms of industry standard classifications, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. The attack vector corresponds to ATT&CK technique T1499, specifically Endpoint Denial of Service via application exhaustion or crash mechanisms. Although the CVSS 3.1 base score is rated at 4.4 indicating a medium severity level primarily due to availability impact, the requirement for high privileges limits its immediate threat landscape compared to remote code execution flaws. However, given that internal network access can sometimes be gained by compromised low-privilege accounts or through lateral movement within an organization, the risk remains significant for organizations with weak internal segmentation policies.
Mitigation strategies should prioritize applying the latest security patches provided by Oracle for all affected versions listed above. Organizations must ensure their patch management processes are up to date and that testing cycles include validation of Net Services stability after updates. Additionally, implementing strict network access controls can limit exposure; while high privileges are required on the infrastructure, restricting who has administrative or elevated login rights to database servers reduces the attack surface. Monitoring for unusual patterns in connection attempts or resource usage spikes within Oracle Net Services logs can also aid in early detection of exploitation attempts before a full crash occurs.