CVE-2026-46834: Oracle Database Net Service DoS Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-46834 is a network-accessible denial-of-service flaw in the Oracle Database Server Net Service component, rooted in improper resource handling (CWE-400). The vulnerability is easily exploitable due to a low attack complexity, no authentication requirement, and no user interaction needed. An unauthenticated network attacker can send crafted TLS traffic to trigger uncontrolled resource consumption, resulting in service unavailability. The CVSS 3.1 score of 7.5 reflects the high availability impact with no confidentiality or integrity compromise.

Business impact

This vulnerability poses a direct operational risk to organizations running Oracle Database Server in the affected versions. An attacker can cause repeated denial-of-service conditions, disrupting database availability and cascading to dependent applications and services. This impact intensifies in environments where database uptime is critical to business continuity, particularly for transaction-heavy or mission-critical systems. Recovery requires manual intervention and service restart, extending downtime and potential revenue loss.

Affected systems

Oracle Database Server versions 23.4.0 through 23.26.2 are affected. Any deployment of these versions with the Net Service component exposed to untrusted network segments is at risk. Organizations should audit their Oracle Database infrastructure to identify which systems run affected versions and assess their network exposure.

Exploitability

This vulnerability is highly exploitable. It requires only network access and can be triggered via standard TLS connections without authentication or user interaction. The low attack complexity means an attacker does not need specialized techniques or timing conditions. The absence of KEV status does not indicate low exploit risk; the technical characteristics alone indicate straightforward exploitability for any attacker with network reach to the Oracle Net Service listener port.

Remediation

Patching is the primary remediation. Organizations must upgrade Oracle Database Server to a patched version outside the affected range (verify against the Oracle critical patch advisory for the specific patch version addressing this CVE). Interim mitigation includes restricting network access to the Oracle Net Service listener to trusted hosts only, using firewall rules or host-based access controls to limit connections to administrative networks and known client systems.

Patch guidance

Consult the Oracle critical patch advisory corresponding to the CVE publication date (2026-05-28) to identify the specific patched version for your Oracle Database Server release. Apply patches during a scheduled maintenance window, as they typically require database restart. Test patches in a non-production environment first to verify compatibility with existing applications and custom configurations. Prioritize patching for systems exposed to untrusted networks.

Detection guidance

Monitor Oracle Database Net Service logs for repeated connection resets, listener crashes, or service hangs that correlate with unexpected network traffic. Network sensors should flag suspicious TLS traffic patterns targeting the Oracle listener port (default 1521) from unexpected sources. Check for sudden spikes in resource consumption or connection attempts. Establish baseline monitoring of Net Service availability and trigger alerts on anomalous terminations.

Why prioritize this

This vulnerability merits rapid prioritization due to its high CVSS score (7.5), ease of exploitation, lack of authentication barriers, and direct impact on database availability. While it does not enable data theft or system compromise, denial-of-service attacks on databases undermine operational continuity. Organizations should treat this with the same urgency as active threats to their database infrastructure. The affected version range (23.4.0–23.26.2) suggests relatively recent releases, likely deployed in modern environments.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by network accessibility (AV:N), low attack complexity (AC:L), no authentication requirement (PR:N), no user interaction (UI:N), and high availability impact (A:H). The absence of confidentiality and integrity impacts prevents a critical rating. For organizations dependent on continuous database availability, the actual risk may warrant internal elevation above the base CVSS score when factored with business criticality.

Frequently asked questions