Oracle Net Services EUVD-2026-105924

Exploitation requires the attacker to already have high-privilege local logon access to the infrastructure/host where Oracle Net Services executes (AV:L, PR:H) - it is NOT remotely exploitable over the network and does not work against unauthenticated or low-privileged actors. No user interaction is needed (UI:N). The limiting factors are significant: the prerequisite of pre-existing high local privileges on the database server means an attacker must already be a trusted/privileged presence on the host, which is why real-world risk is low. Impact is confined to availability of Oracle Net Services (a hang or repeatable crash / complete DOS); there is no confidentiality or integrity impact and no scope change. Affected deployments are Oracle Database Server running Oracle Net Services in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3.

This is a genuinely low-priority issue despite being a flaw in a ubiquitous database platform. The CVSS 3.1 base score of 4.4 (MEDIUM) is driven entirely by an availability impact (A:H, with C:N/I:N) and is strongly constrained by the vector: AV:L means the attacker must already have local logon access to the host where Oracle Net Services runs, and PR:H means they must already hold high privileges on that infrastructure. In practice, an actor with high local privileges on a database host has far more impactful options than triggering a listener hang/crash, which substantially reduces real-world significance. No EPSS score, KEV listing, or POC was provided; per precision rules this is 'no public exploit identified at time of analysis.' The SSVC picture (not supplied) would almost certainly land at low/track given local-only, high-privilege, availability-only impact. The only mild tension worth noting: Oracle's boilerplate phrase 'Easily exploitable' corresponds to AC:L but should not be read as low barrier to entry - the PR:H and AV:L prerequisites are the real gating factors and dominate the risk calculus.

An attacker who has already obtained a high-privilege local account on the server hosting Oracle Net Services (e.g., a privileged OS user on the database host) sends or configures input that causes the Net Services listener process to hang or repeatedly crash, denying database connectivity to legitimate clients. No code execution or data disclosure results - the impact is a complete denial of service of the networking component only. No public exploit code was identified in the provided intelligence.