EUVD-2026-46527
GHSA-9vwg-jr6q-mqf6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Oracle Net listener on TCP 1521
-
DeliverySend crafted TNS protocol request
-
ExploitTrigger flaw in Net Services handler
-
ExecutionDisclose accessible data or crash component
-
ImpactConfidentiality loss and complete DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle Net Services listener endpoint (Oracle Net / TNS, default TCP 1521) on an affected Oracle Database Server (19.3-19.31, 21.3-21.22, or 23.4.0-23.26.2). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions beyond that - exploitation is remote and unauthenticated with no user interaction against the component as deployed. The primary limiting factor is network exposure of the listener: instances where port 1521 is firewalled, bound to internal-only interfaces, or protected by Valid Node Checking are substantially harder to reach, and the affected version must be one of the listed releases. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H describes an easily exploitable, network-reachable, unauthenticated flaw with no user interaction - the highest-concern signal profile short of active exploitation, and Oracle's own 'easily exploitable' language reinforces the AC:L rating. Countervailing signals: there is no public exploit identified at time of analysis, the CVE is not in CISA KEV, and no EPSS score or SSVC decision was provided in the input, so real-world exploitation likelihood cannot be quantified from the data given. Integrity impact is explicitly None (I:N), so this is a confidentiality-and-availability issue, not a code-execution or data-tampering issue despite the 9.1 score. Net assessment: treat as a genuine high priority because the affected component is network-exposed and unauthenticated, but note the absence of EPSS, KEV, and POC data means the priority rests on intrinsic exploitability rather than observed attacks. |
| Exploit ScenarioDerived | An attacker with network reachability to the Oracle Net Listener (TCP 1521) sends crafted TNS protocol traffic directly to the database's networking layer without any credentials or user interaction. The malformed request either coerces the Net Services component into disclosing data it can access or drives it into a repeatable crash/hang, taking database connectivity offline. No public exploit code has been identified at time of analysis, but the low attack complexity means weaponization would be straightforward for an attacker who can reach the port. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Unauthenticated remote compromise of Oracle Net Services affects Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, letting a network attacker reaching the database listener over Oracle Net (typically TCP 1521) read all data accessible to the component and hang or repeatedly crash it for a complete denial of service. Rated CVSS 3.1 9.1 with high confidentiality and availability impact and no integrity impact, it requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing nature make it a high remediation priority.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though the input does not specify an exact fixed build number, so obtain the precise patched version and platform-specific patch ID directly from the CPU matrix for your 19c/21c/23ai release. Where immediate patching is not possible, restrict access to the Oracle Net Listener port (default TCP 1521) using network firewalls and database-side Valid Node Checking (invited_nodes/excluded_nodes in sqlnet.ora) to limit which hosts can open Net sessions - this shrinks the unauthenticated attack surface at the cost of maintaining an allowlist that can break legitimate clients if incomplete; place the listener behind a bastion or VPN so it is never directly internet-reachable; and enable listener logging and monitoring for anomalous connection or crash patterns to detect DoS attempts. These controls mitigate exposure but do not remove the underlying flaw, so patching remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Net Services is the connectivity layer of Oracle Database, comprising the TNS (Transparent Network Substrate) protocol, the Oracle Net Listener, and Net foundation libraries that broker all client-to-database and database-to-database sessions, normally exposed on TCP port 1521. The CPE cpe:2.3:a:oracle_corporation:oracle_net_services identifies the affected component as the Net stack itself rather than the SQL engine, meaning the flaw lives in protocol handling reachable before any database authentication occurs. Oracle assigned no CWE (listed N/A); based on the impact profile (data disclosure plus repeatable crash without integrity impact) the root cause is consistent with improper input validation or memory/state handling in the TNS protocol parser. The supplied 'Authentication Bypass' tag together with the PR:N vector indicates the attack surface is pre-authentication protocol processing.
Know when Oracle Net Services gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Listener is network-reachable and pre-authentication (AV:N/PR:N/AC:L per Oracle 'easily exploitable'); data disclosure gives C:H and repeatable crash gives A:H, with no integrity impact (I:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Net Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Executive ViewAI
Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2) is vulnerable to unauthenticated remote compromise allowing attackers to read all data accessible to the database and trigger complete denial of service, with no vendor patch currently available. A network attacker can exploit this without credentials, creating concurrent data breach and business continuity risk across affected deployments.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict TCP 1521 network access via firewall to trusted hosts only; implement continuous database activity monitoring with alerting on anomalous connection attempts and unauthorized data access; audit and minimize database user privileges to reduce exposed data scope; consider deploying network-level access controls to gate Oracle Net traffic; establish and rehearse incident response procedures for unauthorized database access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB