Oracle Net Services CVE-2026-83349

No special conditions beyond network reachability to the Oracle Net listener on the target database server - the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication, no user interaction, and no non-default database feature is required. The practical limiting factors are deployment-dependent: if the TNS listener port (default 1521) is restricted by firewall, security group, or Oracle Valid Node Checking so that only trusted application subnets can connect, the attacker must already be positioned on an allowed network segment; if the listener is exposed to the internet or an untrusted VLAN, the barrier is essentially zero. The impact is bounded to availability of Oracle Net Services (C:N/I:N/A:H) - there is no data disclosure or modification path described - and the affected releases are specifically 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3, so installations outside those ranges are not targeted by this advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) describes a low-skill, pre-authentication, network-delivered denial of service - the most automatable class of issue, and Oracle explicitly labels it 'easily exploitable'. The mitigating signal is that impact is confined to availability: no confidentiality or integrity loss, and scope is unchanged, so this is not a stepping stone to data theft or code execution. Against that, EPSS data was not supplied, KEV status is not present (so exploitation is not confirmed actively exploited (CISA KEV)), and no POC was identified, meaning the real-world weaponization picture is genuinely unknown rather than negative. Oracle Net listeners are frequently exposed for application connectivity, so an unauthenticated remote crash of the listener or database service is a credible enterprise availability risk; however, the absence of any EPSS, KEV, or POC signal means this should be prioritized as a hardening and patching item rather than an emergency incident. The missing CWE and missing EPSS inputs are data gaps that reduce confidence in the exploitability assessment - treat the 7.5 score as the primary, vendor-confirmed signal.

An unauthenticated attacker with network reachability to the Oracle Net listener sends a crafted Oracle Net/TNS protocol request that triggers the flawed code path, causing the listener or Net Services process to hang or crash repeatedly. Because the attack is low-complexity and needs no credentials or user interaction, it can simply be looped to keep the service unavailable, denying database connectivity to all applications and users served by that listener. No public exploit code was identified at time of analysis, so the attacker would need to develop or obtain the malformed request independently.