CVE-2026-83348 in Database Server
Summary
by MITRE • 09/16/2026
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create DB Link privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Relational Database Management System component of Oracle Database Server, affecting supported versions including releases from 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. This flaw represents a critical security deficiency that allows for the compromise of database integrity when exploited by an attacker with specific network access capabilities. The vulnerability is characterized as easily exploitable, indicating that it does not require complex conditions or sophisticated techniques to trigger, thereby increasing the likelihood of successful exploitation in environments where proper segmentation and privilege management are not strictly enforced.
The technical nature of this flaw permits a low-privileged attacker who possesses Create DB Link privileges within the database environment to execute unauthorized actions remotely via Oracle Net. The creation of database links is a standard administrative feature allowing one database instance to access objects on another, but in this context, it serves as an attack vector for privilege escalation and lateral movement. By leveraging network connectivity through Oracle Net, the attacker can manipulate these link configurations or associated processes to bypass existing security controls. This capability effectively neutralizes the protective barriers intended by lower-level account restrictions, allowing the adversary to interact with system components beyond their authorized scope.
The operational impact of a successful exploitation is severe, resulting in complete takeover of the RDBMS instance. With an attacker gaining control over the database server, they can read, modify, or delete sensitive data stored within the databases managed by that instance. This leads to significant breaches of confidentiality as proprietary and personal information becomes accessible. Furthermore, integrity impacts arise from the ability to alter critical system configurations or application data without detection. Availability is also compromised, as an attacker may disrupt database services through resource exhaustion or destructive commands, leading to downtime for dependent applications and business operations.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, specifically regarding the abuse of administrative privileges such as creating database links to escalate rights beyond their intended level. It also relates to CWE-78 OS Command Injection if the exploitation involves executing system-level commands through the database interface, although the primary mechanism described focuses on privilege escalation via network-accessible features. In terms of adversary tactics, this scenario maps directly to MITRE ATT&CK technique T1021 Remote Services, particularly Oracle Database connections, and potentially T1548 Abuse Elevation Control Mechanism if the exploit allows bypassing operating system or database security restrictions. The high severity is reflected in a CVSS 3.1 Base Score of 8.8, indicating High impact on confidentiality, integrity, and availability with low attack complexity and no user interaction required beyond network access.
Mitigation strategies must prioritize immediate patching to the latest available version within the supported release branches mentioned above. Organizations should also enforce strict least-privilege principles by auditing accounts that hold Create DB Link privileges and restricting this capability only to necessary administrative roles. Network segmentation is critical; Oracle Net listeners should not be exposed directly to untrusted networks, and access controls must restrict connections from unauthorized IP addresses. Additionally, implementing robust monitoring for unusual database link creation activities or unexpected network traffic patterns can aid in early detection of exploitation attempts while patches are being deployed.