EUVD-2026-33013
GHSA-54vv-8mw9-m99f
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. While the vulnerability is in Net Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Net Service. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Net Service takeover in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated remote attackers reaching the TLS-protected Net Service listener to fully compromise confidentiality, integrity, and availability, with scope change indicating impact on adjacent components. CVSS 9.0 reflects high impact tempered by high attack complexity (AC:H), and no public exploit identified at time of analysis. Reported and tracked in Oracle's May 2026 Critical Patch Update advisory.
Technical ContextAI
Oracle Net Services is the connectivity layer (formerly SQL*Net) that brokers client-server communication for Oracle Database, including TNS Listener and the encrypted TLS transport used by Oracle Net. The affected CPE (cpe:2.3:a:oracle_corporation:oracle_database_server) covers Oracle Database Server 23c (versions 23.4.0 through 23.26.2). No CWE is published, but the scope-change behavior (S:C) combined with TLS-layer compromise suggests a flaw in the network protocol handling or TLS implementation within Net Services that allows the attacker's privileges to extend beyond the vulnerable component into other Oracle subsystems that trust Net Service-mediated connections.
RemediationAI
Apply the patches published in Oracle's May 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspumay2026.html); exact fixed version is documented in the CPU matrix and should be applied per Oracle's recommended upgrade path for 23c deployments running 23.4.0-23.26.2. Until patched, restrict network reachability to the Oracle Net listener (typically TCP/1521 or the TLS port TCP/2484) using firewalls or Oracle Connection Manager so that only trusted application tiers can reach Net Service - note this breaks any direct database access from untrusted networks and requires bastion or proxy access for DBAs. Enable Oracle Valid Node Checking (tcp.invited_nodes / tcp.validnode_checking in sqlnet.ora) as a compensating control to limit which client IPs can complete a connection, accepting the operational overhead of maintaining the allow-list.
More in Oracle Database Server
View allFull database takeover in Oracle Database Server's RDBMS component allows an authenticated, low-privileged user with onl
Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticat
Remote denial of service in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated network attackers to cr
Remote denial-of-service in Oracle Database Server's Net Service component (versions 23.4.0 through 23.26.2) allows unau
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to comp
Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operat
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding o
Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, dele
Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-a
Confidentiality breach in the JDBC component of Oracle Database Server allows an unauthenticated attacker positioned on
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via netwo
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today