CVE-2026-91479: Medium severity Oracle Database Server vulnerability
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the RDBMS executes to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Oracle Database Server deployments running affected supported versions 23.4.0 through 23.26.3 are exposed when an attacker can access the physical communication segment connected to the hardware hosting the RDBMS. The attack does not require credentials or user interaction.
What is the expected impact if exploitation succeeds?
Successful exploitation can cause the RDBMS to hang or crash repeatedly, resulting in a complete denial of service. The provided CVSS information identifies availability impact only, with no stated confidentiality or integrity impact.
Does an attacker need database access or an authenticated account?
No. Exploitation is described as unauthenticated and requires no privileges, but the attacker must have adjacent-network access to the relevant physical communication segment.