CVE-2026-83271

Received Received - Intake

Privilege Escalation in Oracle Database Server RDBMS

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Execute on DBMS_REDEFINITION privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83271

EUVD

EUVD-2026-79623

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	database_server	From 19.3 (inc) to 19.32 (inc)
oracle	database_server	From 21.3 (inc) to 21.23 (inc)
oracle	database_server	From 23.4.0 (inc) to 23.26.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the RDBMS component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. It allows a low-privileged attacker with Execute on DBMS_REDEFINITION privilege and network access to compromise the RDBMS, potentially leading to a full takeover of the database system.

Detection Guidance

Detection requires checking Oracle Database Server versions 19.3-19.32, 21.3-21.23, or 23.4.0-23.26.3. Use SQL queries to verify installed versions and check for DBMS_REDEFINITION privilege assignments. Monitor network traffic for suspicious Oracle Net connections to the RDBMS component.

Impact Analysis

An attacker could exploit this to gain full control over the Oracle Database Server, leading to unauthorized access, data theft, data manipulation, or disruption of database services. This could result in significant data breaches or operational disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Apply Oracle's latest security patches immediately. Restrict network access to Oracle Net via firewalls. Review and revoke unnecessary Execute privileges on DBMS_REDEFINITION. Monitor for unusual database activity and unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-83271. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70