EUVD-2026-33014
GHSA-2qv6-qqvc-2gcp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Oracle TCPS listener
-
DeliveryInitiate TLS connection to Net Service
-
ExploitSend crafted handshake/TNS payload
-
ExecutionTrigger unhandled condition in listener
-
PersistListener hangs or crashes
-
ImpactRepeat on restart for sustained outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker needs network reachability to the Oracle Net Service over TLS (typically the TCPS listener endpoint, default port 2484, or any TLS-enabled Net listener) on an Oracle Database Server running 23.4.0 through 23.26.2. No credentials, no user interaction, and no special database configuration beyond having TLS-enabled Net Services exposed are required (PR:N/UI:N/AC:L). The principal limiting factor is exposure: databases whose listener is firewalled to application servers only are not reachable by external attackers, and deployments that have not enabled TCPS may not expose the specific TLS code path described. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a low-complexity, unauthenticated, network-reachable availability attack - the worst possible profile for a DoS bug, which is why it scores 7.5 despite no confidentiality or integrity impact. There is no EPSS score, KEV listing, or public POC supplied in the intelligence, which tempers urgency: the realistic threat today is opportunistic or targeted disruption rather than mass automated exploitation. The bug is particularly relevant where the Oracle Listener/TLS endpoint is exposed beyond a trusted management network; for internet-isolated databases the practical risk is materially lower than the 7.5 score implies. CWE is N/A in the source data, so the exact root cause is not independently verifiable from this input. |
| Exploit ScenarioDerived | An attacker who can reach the database's TLS listener (e.g., an exposed TCPS port on 2484, or any internal foothold able to talk to 1521/TCPS) sends a crafted sequence over TLS to the Net Service that triggers the hang/crash condition, and repeats it on every restart - taking the database offline to all clients without ever authenticating. No POC is referenced in the supplied intelligence, so exploitation today would require independent vulnerability research or reverse-engineering of the May 2026 CPU. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Remote denial-of-service in Oracle Database Server's Net Service component (versions 23.4.0 through 23.26.2) allows unauthenticated attackers with TLS network access to hang or repeatedly crash the listener, producing a complete DoS of database connectivity. The flaw is rated CVSS 7.5 (availability-only) and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
RemediationAI
Apply the fixes shipped in the Oracle Critical Patch Update of May 2026 (https://www.oracle.com/security-alerts/cspumay2026.html); patch availability is confirmed by the vendor advisory but an exact post-fix build number is not provided in this input, so consult the CPU matrix for the precise RU/RUR that supersedes 23.26.2 in your environment. As a compensating control until patching, restrict TCP/IP reachability of the TNS listener (default 1521 and any TCPS/TLS port such as 2484) to known application tiers via firewall or Oracle Connection Manager / valnode (TCP.VALIDNODE_CHECKING with TCP.INVITED_NODES) - the trade-off is operational overhead and the risk of breaking ad-hoc DBA tooling. Where TLS is not strictly required, temporarily disabling the TCPS endpoint removes the specific attack path described but obviously eliminates encrypted client connectivity. Monitor listener.log and alert.log for repeated abnormal disconnects or listener restarts as a detection signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Net Services is the connectivity layer that brokers client/server sessions to the Oracle Database (typically via the TNS Listener on port 1521 or TLS-enabled equivalents such as 2484). The affected CPE is cpe:2.3:a:oracle_corporation:oracle_database_server, scoped to the 23c release line (23.4.0-23.26.2). No CWE was assigned by Oracle, but the symptom - a remotely triggered hang or repeatable crash reached over TLS without authentication - is consistent with an unhandled exception or resource-exhaustion class defect in the TLS handshake or TNS protocol parsing prior to session authentication, since exploitation does not require valid credentials.
Know when Oracle Database Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Net Service. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Database Server versions 23.4.0-23.26.2 expose organizations to remote denial-of-service attacks that completely disable database services without requiring authentication; affected organizations face potential business-critical downtime until patches become available. Because no vendor patch is currently deployed, interim network security controls and monitoring must be implemented immediately to prevent exploitation. This vulnerability affects the foundational system serving most application workloads and demands immediate executive attention.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict TLS network access to the Oracle listener using firewall rules to allow connections only from known application servers; (2) implement connection pooling with health checks on application tier to detect and failover from listener unavailability; (3) establish continuous monitoring and alerting for listener restarts or connectivity drops; (4) deploy database listener redundancy or clustering if architecturally feasible; (5) maintain automated listener restart scripts and tested recovery runbooks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Oracle Database Server
View allNet Service takeover in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated remote attackers reaching t
Full database takeover in Oracle Database Server's RDBMS component allows an authenticated, low-privileged user with onl
Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticat
Remote denial of service in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated network attackers to cr
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to comp
Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operat
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding o
Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, dele
Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-a
Confidentiality breach in the JDBC component of Oracle Database Server allows an unauthenticated attacker positioned on
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via netwo
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected
Exploit-DB