EUVD-2026-79416
GHSA-48xq-mf9f-mqwp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Network-reachable Oracle Net attack needing a valid low-privileged account (PR:L), low complexity, no interaction, and availability-only impact with scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS. CVSS 3.1 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).
AnalysisAI
A denial-of-service flaw in the RDBMS component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets a low-privileged, authenticated user reach the database over Oracle Net and force a hang or repeatable crash of the instance. The CVSS 3.1 base score of 7.7 reflects network reachability, low attack complexity and a Scope Change because the outage can ripple into dependent applications layered on the database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have a valid Oracle Database account with the low-privileged 'Authenticated User' privilege (per the CVSS PR:L metric, authentication is required) and must be able to reach the RDBMS over Oracle Net - typically TCP port 1521 on the database listener. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) describes a remotely reachable, low-complexity attack that requires only a legitimate low-privileged database account and no user interaction, producing full availability loss with a scope change - a combination that is operationally serious for any organisation whose business processes sit on an Oracle instance, and even a mid-sized municipal IT team in bytom should treat this as urgent for production databases. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in advisory https://www.oracle.com/security-alerts/cspusep2026.html - this is the primary and only vendor-supported fix, and it should be applied to every Oracle Database Server instance running 23.4.0 through 23.26.3; the advisory is the authoritative source for the exact patch number and any required one-off patches, so verify the patch identifier there rather than assuming a version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today