Oracle Database Server CVE-2026-83088

The attacker must have a valid Oracle Database account with the low-privileged 'Authenticated User' privilege (per the CVSS PR:L metric, authentication is required) and must be able to reach the RDBMS over Oracle Net - typically TCP port 1521 on the database listener. There is no user interaction requirement (UI:N) and no special race condition (AC:L), so a single crafted request is sufficient, and it is repeatable for sustained denial of service. Exploitation is limited by network reachability of the Oracle Net listener (an attacker who cannot route to the listener cannot exploit it), by the need for at least one usable database credential, and by the affected version band 23.4.0-23.26.3 - instances on versions outside that range, or deployments where the listener is firewalled to trusted application subnets only and accounts are tightly controlled, face substantially reduced exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) describes a remotely reachable, low-complexity attack that requires only a legitimate low-privileged database account and no user interaction, producing full availability loss with a scope change - a combination that is operationally serious for any organisation whose business processes sit on an Oracle instance, and even a mid-sized municipal IT team in bytom should treat this as urgent for production databases. The confidentiality and integrity metrics are None, so the flaw is purely disruptive: no data theft, no tampering, just outage. No EPSS score, no CISA KEV listing and no public proof-of-concept were provided, which means there is no evidence of exploitation in the wild and the practical priority is driven by exposure (internet- or partner-reachable TNS listeners, shared multi-tenant accounts) rather than by active campaigns. Note that the attack requires a valid credential, so environments that strictly limit and rotate database accounts materially reduce the attacker pool; conversely, anyone with an application account can trigger it. The absence of EPSS data and of an explicit vendor POC statement is a genuine intelligence gap - the score alone should not be read as evidence of active exploitation.

An attacker holding any valid low-privileged database account (for example one harvested from a compromised application server or an over-permissive service account) connects to the Oracle Net listener and issues a crafted request that the RDBMS component mishandles, causing the instance to hang or crash repeatedly. Because the trigger is repeatable with low complexity, the attacker can sustain the outage simply by reconnecting and resubmitting the request, denying service to every application that depends on that database.