EUVD-2026-79700
GHSA-rfc8-ww65-r55w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Network-reachable unauthenticated TCPS attack with low complexity, but a non-attacker user action is required (UI:R) and only availability is affected.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Net Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
AnalysisAI
A denial-of-service flaw in the Oracle Net Services component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets an unauthenticated attacker with network access over TCPS hang or repeatedly crash the Net Services layer, degrading or halting database connectivity. Exploitation is network-reachable and low-complexity but requires interaction from a person other than the attacker, and it yields availability impact only (CVSS 3.1 base 6.5, C:N/I:N/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Required: an Oracle Database Server 23.4.0-23.26.3 instance running Oracle Net Services with a TCPS listener reachable from the attacker's network position; the attack is unauthenticated (CVSS PR:N) and low complexity (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity, unauthenticated attack whose only payoff is availability loss - confidentiality and integrity are explicitly unaffected, and scope is unchanged, so blast radius is limited to the Net Services availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle lists this issue under its Critical Security Patch Update advisory (https://www.oracle.com/security-alerts/cspusep2026.html); apply the Oracle CPU/patch set that covers Oracle Net Services for Database 23.x - patch availability is confirmed per vendor advisory, but the exact fixed build number is not stated in the provided data and must be taken from the advisory itself. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today