Oracle Database EUVD-2026-33013

Exploitation requires network reachability to the Oracle Net Service TLS endpoint (typically the TNS Listener configured for TCPS, e.g., port 2484) on Oracle Database Server 23c at versions 23.4.0 through 23.26.2; no authentication and no user interaction are required (PR:N/UI:N). Limiting factors are the high attack complexity (AC:H) - implying the attacker must satisfy non-trivial preconditions such as specific TLS configuration, timing windows, or protocol state - and the requirement that the target actually expose Net Service over TLS rather than only over unencrypted TCP. Deployments where Net Services is firewalled off from untrusted networks or restricted via Valid Node Checking materially raise the bar even though the vulnerability itself does not require authentication.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) yields a 9.0 base score driven by full CIA impact and scope change, but tempered by high attack complexity, meaning successful exploitation likely requires specific conditions such as race windows, particular TLS handshake states, or non-default configurations. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so this is not currently confirmed actively exploited. Because Net Services is internet-exposed in many Oracle deployments and a successful attack yields cross-component takeover, this should be treated as a high-priority patch despite AC:H - Oracle CPU bulletins historically attract exploit development within weeks of disclosure. The single Oracle advisory reference limits independent corroboration; CWE absence and lack of vulnerability detail (typical of Oracle CPUs) mean defenders cannot independently triage exploitability.

An attacker with TCP reach to the Oracle TLS Net Service port initiates a crafted TLS connection to the listener and exploits the protocol-handling flaw during or after the handshake, requiring no credentials but needing specific timing or state conditions (AC:H). Because of scope change, the resulting compromise of Net Service is leveraged to manipulate or take over additional Oracle subsystems that trust connections brokered by Net Services, ultimately yielding control over database-adjacent components.