What is the CVSS score of CVE-2026-46835?

CVE-2026-46835 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle Database Server are affected by CVE-2026-46835?

Oracle Database Server versions 23.4.0 through 23.26.2 contain a remote availability vulnerability allowing unauthenticated attackers to crash or hang the database service via crafted TLS traffic.

How to fix or mitigate CVE-2026-46835?

Within 24 hours: identify all systems running Oracle Database 23.4.0-23.26.2 and determine which are accessible on untrusted networks. Within 7 days: implement network segmentation and firewall rules restricting TLS connections to the database to authorized sources only; enable monitoring and alerting for suspicious TLS traffic patterns. Within 30 days: monitor Oracle advisories for patch release; test upgrade path to version 23.26.3 or later; implement connection rate limiting and TLS session timeouts as interim controls.

Oracle Database Server CVE-2026-46835

EUVD-2026-33015 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-28 oracle

GHSA-hjj7-gh89-r5p6

Denial Of Service Oracle Oracle Database Server

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 21:22 vuln.today

DescriptionCVE.org

Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Net Service. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Remote denial of service in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated network attackers to crash or hang the Net Service component via crafted TLS traffic. The flaw scores CVSS 7.5 with availability-only impact and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability sits in the Net Service component of Oracle Database Server, the networking layer (commonly associated with Oracle Net Listener and TNS) that brokers client connectivity to the database instance over TLS-protected channels. Because the issue is reachable over TLS without authentication, the defect likely lies in TLS handshake or session handling code paths processed before any database-level credentials are validated. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_database_server, covering the 23ai (23c) release train between 23.4.0 and 23.26.2; the NVD CWE is not assigned, but the symptoms (hang or repeatable crash from a single network actor) are characteristic of resource exhaustion, unhandled exception, or null-dereference classes (CWE-400/CWE-476/CWE-755 family).

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of May 2026 (advisory https://www.oracle.com/security-alerts/cspumay2026.html); exact patched build numbers are listed in the CPU matrix and should be matched to your platform - patch availability is confirmed per Oracle CPU but a specific fixed version was not provided in the input data, so consult the CPU patch availability table for your exact release. Until patching, restrict TCP reachability to the Oracle Net listener (default 1521/TLS variants) to known application/jump hosts via host firewall, network ACLs, or Oracle Connection Manager, and consider enabling Valid Node Checking (tcp.validnode_checking with tcp.invited_nodes) in sqlnet.ora - note that this hardens against arbitrary network sources but does not help if a compromised application host sends the malicious TLS traffic. Avoid disabling TLS as a 'workaround' since that trades a DoS for an eavesdropping exposure.