CVE-2026-101510

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Oracle Database Server

Publication date: 2026-10-20

Last updated on: 2026-11-05

Assigner: Oracle

Description

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows high privileged attacker having None privilege with logon to the infrastructure where Oracle Net Services executes to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-05

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101510

EUVD

EUVD-2026-105924

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Net Services	19.3
Oracle Corporation	Oracle Net Services	21.3
Oracle Corporation	Oracle Net Services	23.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Net Services, part of Oracle Database Server. It affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An attacker with high privileges and local access can exploit it to cause Oracle Net Services to hang or crash repeatedly, leading to a denial of service (DOS).

Detection Guidance

This vulnerability affects Oracle Net Services in Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Detection requires checking the installed Oracle Database Server version and verifying if Oracle Net Services is running. Use commands like 'sqlplus / as sysdba' to check the database version and 'lsnrctl status' to inspect Oracle Net Services listener status.

Impact Analysis

If you use an affected Oracle Database Server version, an attacker with local access and high privileges could disrupt Oracle Net Services, causing service outages or instability. This may lead to downtime for database-dependent applications.

Compliance Impact

This vulnerability causes denial-of-service (DOS) conditions in Oracle Net Services, which could disrupt database availability. While not directly tied to data breaches, prolonged unavailability may impact compliance with availability requirements in GDPR (Article 32) and HIPAA (Security Rule).

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle Database Server to address the vulnerability in Oracle Net Services. Ensure the patch is applied to all affected versions (19.3-19.32, 21.3-21.23, 23.4.0-23.26.3).

Hi! I’m here to help you understand CVE-2026-101510. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...