Oracle Database Server CVE-2026-83351

Exploitation requires network reachability to the Oracle Net (TNS) listener on the affected RDBMS instance - the CVSS vector confirms AV:N with PR:N and UI:N, so no credentials and no user interaction are needed. The CVSS AC:H metric and Oracle's 'difficult to exploit' classification mean the attacker must satisfy non-trivial, attacker-uncontrolled preconditions (typically a narrow protocol state or timing window in the Oracle Net/RDBMS negotiation); the exact precondition is not disclosed by Oracle and no CWE was assigned, so it cannot be confirmed from the available data. Exploitation is further limited to Oracle Database Server versions 23.4.0 through 23.26.3; instances outside that range, or listeners isolated behind firewalls, connection managers, or private network segments, are not exploitable through this vector.

The CVSS 3.1 vector is unauthenticated and network-reachable (AV:N, PR:N, UI:N) with high impact to all three security objectives, which is why it scores 8.1 - but AC:H is the dominant mitigating metric and matches Oracle's 'difficult to exploit' language, so this is not a spray-and-pray bug. No EPSS score, KEV entry, or public POC was provided in the input, meaning there is no confirmed evidence of exploitation in the wild; the practical risk therefore concentrates on internet- or partner-network-exposed Oracle Net listeners, which are common in poorly segmented enterprise environments and are high-value targets. This should be treated as a prioritized patch (Oracle CSPU) rather than an emergency zero-day response. Note explicitly: exploitation status, EPSS and patch version specifics are unconfirmed - the only vendor-supplied signal is the advisory URL and CVSS. The tag 'Information Disclosure' conflicts with the C/I/A:H vector and appears to be a mislabel; treat the impact as full RDBMS takeover.

An attacker who can route packets to the database host connects to the Oracle Net listener and sends a crafted TNS negotiation payload that drives the RDBMS into the vulnerable state, requiring the specific timing/state conditions implied by AC:H and therefore likely repeated attempts or reconnaissance. Because no authentication or user interaction is required (PR:N/UI:N), a successful attempt yields full read/write control of the database and can lead to data theft, data destruction, or use of the database host as a pivot. No public exploit code was identified at the time of analysis, so a working attack would currently require bespoke development by a skilled adversary.