Oracle Database Server EUVD-2026-106724

Exploitation requires the attacker to have access to the physical communication segment attached to the hardware where the RDBMS executes - i.e., adjacent (Layer-2/local-network) positioning, not internet-routable remote access (CVSS AV:A). Within that segment, no authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L), so any host on the same segment can trigger it. The primary limiting factor is this network-adjacency precondition: the vulnerability cannot be reached across routed/internet boundaries, confining realistic exploitation to insiders or attackers who have already established a foothold on the database's local network. Affects Oracle Database Server RDBMS component, supported versions 23.4.0 through 23.26.3; impact is availability-only (hang or repeatable crash / complete DOS).

This is a moderate-severity availability-only flaw (CVSS 3.1 6.5, A:H with C:N/I:N) in the Oracle Database RDBMS component. The single most important risk-limiting signal is the attack vector: CVSS specifies AV:A (Adjacent), and the description confirms it - the attacker must have access to the physical communication segment attached to the hardware running the RDBMS, so this is NOT internet-routable remote exploitation. Attack complexity is low (AC:L) and no privileges or user interaction are needed (PR:N/UI:N), meaning anyone already on that local segment can trigger it easily, but the adjacency requirement sharply narrows the realistic attacker population to insiders or those who have already gained a foothold on the same L2 network. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit tooling. The impact is confined to a hang or repeatable crash (complete DOS) with no confidentiality or integrity loss. Net assessment: a credible availability concern for databases reachable on sensitive network segments, but it is a patch-in-normal-cycle issue rather than an emergency - the headline risk is bounded by the adjacent-network precondition, not the otherwise-easy exploitability.

An attacker positioned on the same physical/adjacent network segment as the Oracle Database host (e.g., a malicious insider or an actor who has pivoted onto the data-center VLAN) sends crafted traffic to the RDBMS without needing credentials or user interaction. The malformed input drives the database into a hang or repeatedly reproducible crash, producing a complete denial of service for all dependent applications. No public exploit code was identified in the provided data.