CVE-2026-83349

Received Received - Intake

Denial of Service in Oracle Database Server

Publication date: 2026-09-15

Last updated on: 2026-09-16

Assigner: Oracle

Description

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-16

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83349

EUVD

EUVD-2026-79702

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	database_server	From 19.3 (inc) to 19.32 (inc)
oracle	database_server	From 21.3 (inc) to 21.23 (inc)
oracle	database_server	From 23.4.0 (inc) to 23.26.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Net Services, part of Oracle Database Server. It affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker can exploit it remotely via Oracle Net to cause a denial of service (DOS) by crashing or hanging the service repeatedly.

Detection Guidance

This vulnerability affects Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Detection requires checking the installed Oracle Database Server version against these ranges. Use commands like 'sqlplus / as sysdba' followed by 'SELECT * FROM v$version;' to check the version. Monitor network traffic for unusual Oracle Net service requests or crashes.

Impact Analysis

If exploited, this vulnerability can disrupt database operations by making Oracle Net Services unavailable. This could lead to downtime, loss of access to critical database functions, and potential business disruptions for systems relying on Oracle Database Server.

Compliance Impact

This vulnerability causes denial-of-service (DOS) conditions in Oracle Net Services, leading to service unavailability. Such disruptions may violate compliance requirements for availability in standards like GDPR (data processing continuity) and HIPAA (access to critical systems).

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for your Oracle Database Server version to address the vulnerability in Oracle Net Services.

Hi! I’m here to help you understand CVE-2026-83349. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70