CVE-2026-83347: Medium severity Oracle Oracle Database Server (Oracle Net Services) vulnerability
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Net Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle Database Server deployments using the Oracle Net Services component are affected on supported versions 23.4.0 through 23.26.3. The attack path requires network access via TCPS.
Does an attacker need credentials or prior access?
No. The vulnerability is exploitable by an unauthenticated attacker with network access via TCPS, but successful exploitation requires human interaction by someone other than the attacker.
What is the expected impact of successful exploitation?
Successful exploitation can cause Oracle Net Services to hang or crash repeatedly, resulting in a complete denial of service. The stated CVSS impacts are limited to availability; confidentiality and integrity impacts are listed as none.