CVE-2026-83350 in Database Server
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Net Services component of the Oracle Database Server, specifically affecting supported versions ranging from 21.3 through 21.23 and version 23.4.0 up to 23.26.3. This security flaw is classified as a critical availability risk due to its potential for causing complete denial of service conditions within the database infrastructure. The vulnerability allows an unauthenticated attacker who has network access via Oracle Net protocols to exploit the defect remotely without requiring any prior authentication or user interaction. This characteristic significantly lowers the barrier to entry for malicious actors, enabling them to target systems that are exposed on public networks or accessible through internal network segments where trust boundaries may be loosely defined.
From a technical perspective, the flaw enables an attacker to trigger conditions that lead to a hang or a frequently repeatable crash of the Oracle Net Services process. This behavior indicates a likely resource exhaustion issue, such as improper handling of specific malformed packets or excessive state accumulation during connection establishment or maintenance phases. When exploited, the service becomes unresponsive or terminates unexpectedly, effectively severing all database connectivity for users and applications relying on that instance. The impact is strictly confined to availability, with no direct implications for data confidentiality or integrity in this specific vector, as indicated by the zero values for Confidentiality and Integrity impacts in the CVSS scoring model.
The operational impact of this vulnerability is severe for organizations dependent on high-availability database environments. A successful exploitation results in a complete denial of service, disrupting business operations that rely on real-time data access. Since the attack requires only network access and no authentication, it poses a significant threat to any Oracle Database instance with its listener port exposed to untrusted networks. Attackers can launch automated attacks against multiple targets simultaneously, causing widespread outages across an enterprise infrastructure. The repeatable nature of the crash means that even if service is restored manually or automatically, the vulnerability remains exploitable until patched, leading to persistent instability and potential data loss for transactions in progress at the time of the crash.
In terms of industry standard classifications, this vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption, as it leads to resource exhaustion causing a denial of service. It also maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-category of Oscillation or Flooding if the attack involves repeated requests designed to overwhelm the Net Services component. The CVSS 3.1 base score of 7.5 reflects the high severity due to the network-based exploitability and complete availability impact, despite the lack of authentication requirements being mitigated by the fact that it does not compromise data integrity or confidentiality directly.
Mitigation strategies should prioritize immediate patching to the latest available version within the supported release lines mentioned above. Oracle typically releases security patches through its Critical Patch Update program, which addresses known vulnerabilities in their software products. Organizations must ensure that their database listeners are configured with strict access control lists to restrict network traffic from untrusted sources until patches can be applied. Additionally, implementing network segmentation and firewalls to limit exposure of the Oracle Net listener port to only authorized IP ranges can reduce the attack surface significantly. Monitoring for unusual spikes in connection attempts or resource usage on the database server may also provide early detection indicators for exploitation attempts before a full denial of service occurs.