CVE-2026-83347 in Database Server
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Net Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Net Services component of the Oracle Database Server, specifically affecting supported versions ranging from 23.4.0 to 23.26.3. This security flaw is classified as an easily exploitable issue that permits unauthenticated attackers with network access via TCPS to compromise the integrity and availability of the service. The attack vector leverages the Transparent Network Substrate, which handles client connections to Oracle databases, allowing malicious actors to target the underlying communication layer without requiring prior authentication credentials. This characteristic significantly lowers the barrier for entry compared to vulnerabilities that require valid user accounts or complex privilege escalation paths.
The operational impact of this vulnerability is primarily centered on availability rather than confidentiality or integrity. Successful exploitation enables an attacker to cause a hang or trigger frequently repeatable crashes, resulting in a complete denial of service condition for Oracle Net Services. This means that database connectivity becomes unavailable to legitimate users and applications relying on the instance. The severity is quantified by a CVSS 3.1 Base Score of 6.5, indicating a medium level of risk. The specific vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) highlights that while the attack requires network access and has low complexity, it notably demands human interaction from someone other than the attacker to fully realize the impact. This user interaction requirement suggests that the exploit may involve social engineering tactics or require a victim to perform an action such as clicking a malicious link or opening a crafted file that initiates the connection attempt against the vulnerable service.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. The mechanism likely involves exhausting system resources through malformed packets or excessive request rates sent via TCPS, causing the Net Services process to become unresponsive or crash repeatedly. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1499, Endpoint Denial of Service, where an adversary aims to disrupt service availability rather than steal data or modify configurations. The reliance on human interaction places elements of social engineering within the broader attack chain, potentially linking to ATT&CK tactic TA0001, Initial Access, if the interaction is coerced through deceptive means.
Mitigation strategies must address both the technical configuration and operational procedures surrounding TCPS connections. Oracle should be updated to the latest patch level that resolves this specific flaw in the Net Services component for versions 23.4.0 through 23.26.3. Administrators are advised to review network access control lists to restrict TCPS port exposure only to trusted IP addresses, thereby reducing the attack surface available to unauthenticated attackers. Additionally, implementing rate limiting on database listener ports can help mitigate resource exhaustion attempts that lead to denial of service conditions. Security awareness training for personnel who might interact with external systems or links is also recommended given the human interaction requirement inherent in this vulnerability's exploitation path. Continuous monitoring of network traffic patterns for anomalies indicative of connection flooding or malformed packet injection should be maintained to detect potential exploitation attempts early.