CVE-2026-83333 in Database Server
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Net Services component of the Oracle Database Server, specifically affecting supported versions ranging from 23.4.0 through 23.26.3. This security flaw is characterized by its high ease of exploitation and critical impact on system availability. The core technical issue involves a condition that allows an unauthenticated attacker to trigger a state within the Net Services layer that leads to service instability. Because Oracle Net Services acts as the primary interface for network-based communication with the database, compromising this component effectively severs or degrades the ability of legitimate users and applications to interact with the database engine. The vulnerability does not require authentication, meaning any entity capable of reaching the server over the network can attempt to exploit it without providing valid credentials.
From a technical perspective, the flaw enables an attacker to cause Oracle Net Services to hang or enter into a state where it frequently repeats crashes. This behavior constitutes a complete denial of service condition for the database connectivity layer. When the net services component hangs or crashes repeatedly, new connection requests are either rejected or processed so slowly that they become effectively useless. Existing connections may be dropped abruptly, leading to data loss in applications that do not have robust reconnection logic. The operational impact is severe because it disrupts all network-based access to the database, regardless of whether the underlying database instance itself remains running and healthy. This creates a scenario where the infrastructure appears online but is functionally inaccessible for its intended purpose.
The severity of this vulnerability is quantified by a CVSS 3.1 Base Score of 7.5, which classifies it as High Severity. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates that the attack vector is Network-based with Low complexity and requires no Privileges or User Interaction. Crucially, while there are no impacts on Confidentiality or Integrity, the impact on Availability is High. This aligns directly with CWE-400, which describes Uncontrolled Resource Consumption leading to Denial of Service conditions. The vulnerability allows an attacker to exhaust resources or trigger a fatal error in the network listener process without needing prior access, making it particularly dangerous for internet-facing database instances that are not properly segmented behind strict firewalls.
In terms of threat modeling and adversary behavior, this vulnerability maps closely to MITRE ATT&CK technique T1499 Endpoint Denial of Service or more specifically T1529 System Shutdown/Reboot if the crash leads to a restart of services. Attackers can leverage this flaw as part of a broader campaign to disrupt business operations by targeting critical infrastructure components. Since no authentication is required, automated scanning tools and malicious actors can easily identify vulnerable systems on public networks or within compromised internal segments where lateral movement has occurred but access controls are lax. The lack of user interaction requirement further lowers the barrier for entry, allowing for widespread exploitation with minimal effort from the attacker side.
Mitigation strategies must focus on immediate patching and network-level defenses. Oracle should be updated to a version that includes the fix for this specific vulnerability in the Net Services component. Until patches are applied or deployed via automated update mechanisms, organizations should implement strict firewall rules to restrict access to port 1521 (or other configured listener ports) exclusively from trusted IP addresses and application servers. Network segmentation is critical here; database listeners should never be exposed directly to untrusted networks such as the public internet without a robust Web Application Firewall or reverse proxy that can filter malicious traffic patterns. Additionally, enabling Oracle Database Advanced Security features like SSL/TLS encryption for client connections does not prevent this specific denial-of-service flaw but adds layers of defense-in-depth by ensuring that even if an attacker reaches the service, they cannot easily intercept other legitimate traffic during the disruption window. Regular vulnerability scanning and monitoring for unusual spikes in connection attempts or listener crashes are essential for early detection of exploitation attempts targeting this weakness.