Oracle Database Server CVE-2026-46835

Reachability to the Oracle Database Server 23ai (23.4.0-23.26.2) Net Service listener over TLS (typically the TCPS endpoint, default 1521 or a custom TCPS port) is the only hard prerequisite - CVSS AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity against a vulnerable default-configured Net Service. Exploitation is limited to organizations running the 23ai release train in the stated band; 19c/21c are not indicated as affected. Practical exposure is further limited where the listener is bound to internal interfaces only, fronted by Oracle Connection Manager, or restricted by Valid Node Checking / network ACLs, all of which prevent untrusted hosts from reaching the vulnerable TLS code path.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a high-availability-only impact reachable remotely with no privileges and no user interaction, which Oracle itself characterizes as 'easily exploitable.' Confidentiality and integrity are unaffected, so this is a pure DoS rather than a database compromise vector - meaningful but not on par with RCE or data-disclosure issues. The CVE is not listed in CISA KEV, no EPSS score was supplied, no SSVC decision is available, and no public exploit identified at time of analysis, so the immediate exploitation pressure appears low; however, the Net Service tier is typically Internet- or intranet-exposed for database clients, and a successful hit takes down database connectivity for all clients, which raises operational risk for organizations that expose the listener beyond tightly controlled application tiers. Treat this as a high-priority patch for any externally reachable Oracle 23ai deployment and as a standard CPU-cycle patch for fully segmented internal deployments.

An attacker who can reach the Oracle Net listener over TLS (for example, a poorly segmented cloud subnet or an Internet-exposed 1521/TCPS port) opens a TLS connection and sends a malformed handshake or session payload that triggers the Net Service hang or crash. Repeated triggers keep the listener unavailable, blocking all database client connectivity until the service is restarted or the attacker stops; no credentials, user interaction, or prior foothold are required, and a basic socket client is sufficient.