EUVD-2026-46532
GHSA-55jc-5v44-h4j7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Oracle Net listener over network
-
DeliveryOpen unauthenticated database session
-
ExploitSend crafted RDBMS request
-
ExecutionTrigger instance hang/crash or data modification
-
ImpactComplete DOS and unauthorized data tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The required condition is network reachability to the Oracle Database Server's Oracle Net (TNS) listener endpoint against affected RDBMS versions 23.4.0-23.26.2; exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N) per the CVSS vector, so a default-configured, network-reachable listener is sufficient. The principal limiting factor is network exposure: an attacker must be able to open an Oracle Net session, so databases isolated behind firewalls, Valid Node Checking, or private segments are not reachable by external attackers, and only the 23.x release family in the stated range is affected - earlier or later fixed builds are out of scope. |
| Impact | Multiple signals converge on genuine priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives network reachability, low complexity, and no authentication, and Oracle itself labels it 'easily exploitable,' which is the strongest weight in the 8.2 score alongside the A:H (complete DOS) impact. However, the signals are not uniformly severe - confidentiality impact is None (C:N), integrity is only Low (I:L, partial unauthorized data modification), and scope is Unchanged, so this is a crash-and-tamper issue rather than full compromise or RCE. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so exploitation probability cannot be quantified from the data; the absence of KEV means no confirmed active exploitation. For internet-exposed or widely-networked database servers this warrants prompt patching given the unauthenticated pre-auth reachability, while databases restricted to trusted network segments face materially lower real-world risk. |
| Exploit ScenarioDerived | An attacker with network reachability to the Oracle Net listener - for example on an internal segment or an unintentionally exposed database host - sends a crafted pre-authentication request that trips the RDBMS defect, hanging or crashing the instance to cause a complete outage. In the same reachable position the attacker can perform unauthorized update, insert, or delete operations against some database-accessible data. No credentials or user interaction are required (PR:N/UI:N), though no public POC was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticated remote attacker reach the database over Oracle Net and trigger a hang or repeatable crash, and additionally gain unauthorized update, insert, or delete access to some database-accessible data. Rated CVSS 3.1 8.2 (High) with network attack vector and low complexity, it requires no privileges or user interaction, making it easily exploitable per Oracle's advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update advisory of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; the exact patched release for the 23.x line should be taken directly from that CPU matrix rather than assumed. Because exploitation traverses Oracle Net, the primary compensating control until patching is to restrict network reachability of the listener: limit access to the 1521/tcp (or configured) Oracle Net port via firewall/security-group rules and Oracle Net Valid Node Checking (tcp.validnode_checking / tcp.invited_nodes) so only trusted application and management hosts can open sessions, accepting that this breaks connectivity for any client not on the allowlist. Ensure no database listener is exposed to the internet, and monitor for anomalous session-establishment patterns and unexpected instance crashes as a detection layer while patches are staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the core RDBMS engine of Oracle Database Server, reachable through the Oracle Net (TNS) listener/session protocol that mediates all client-server database traffic on the default 1521/tcp service. Because the CPE (cpe:2.3:a:oracle_corporation:oracle_database_server) scopes only the database server application and the CVSS vector shows a scope-unchanged (S:U) network attack, the defect is exploitable by any party able to open an Oracle Net session before or without authentication. No CWE was assigned by the source, but the described effect - a low-integrity data modification combined with a high-availability crash reachable pre-auth - is consistent with an input-validation or protocol-parsing weakness in the Net/RDBMS request-handling path rather than a logic bug requiring credentials.
Know when Oracle Database Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Unauthenticated network reach to Oracle Net gives AV:N/AC:L/PR:N/UI:N; effects are complete DOS (A:H) and partial data tampering (I:L) with no confidentiality loss (C:N) and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS as well as unauthorized update, insert or delete access to some of RDBMS accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
Executive ViewAI
Oracle Database Server versions 23.4.0 through 23.26.2 contain a vulnerability enabling unauthenticated remote attackers to trigger database denial of service and gain unauthorized access to modify or delete data; no public exploit code has been identified at time of analysis. Organizations running these database versions face immediate operational risk from potential outages and data integrity breaches.
Until patch availability: implement network segmentation to restrict Oracle Net access to authorized application and administrative hosts only; require multi-factor authentication and VPN for database administrative access; deploy database activity monitoring (DAM) to alert on connection spikes, authentication anomalies, and unauthorized data modification patterns; enforce read-only database roles for non-administrative users where possible; maintain verified backup and recovery procedures with regular testing to minimize business impact from potential data modification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Oracle Database Server
View allNet Service takeover in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated remote attackers reaching t
Full database takeover in Oracle Database Server's RDBMS component allows an authenticated, low-privileged user with onl
Remote denial of service in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated network attackers to cr
Remote denial-of-service in Oracle Database Server's Net Service component (versions 23.4.0 through 23.26.2) allows unau
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to comp
Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operat
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding o
Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, dele
Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-a
Confidentiality breach in the JDBC component of Oracle Database Server allows an unauthenticated attacker positioned on
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via netwo
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected
Exploit-DB