CVE-2026-46835: Oracle Database Server Net Service Denial of Service (CVSS 7.5)

Technical summary

CVE-2026-46835 is a denial-of-service vulnerability in the Net Service component of Oracle Database Server (versions 23.4.0–23.26.2). The flaw exhibits the characteristics of a resource exhaustion or state-management defect (CWE-400) that can be triggered through TLS-based network traffic without authentication. Exploitation requires no special privileges, no user interaction, and minimal attack complexity. The vulnerability results in either a temporary service hang or a complete crash, with no confidentiality or integrity impact—only availability is affected.

Business impact

Successful exploitation causes denial of service to the Oracle Database Server's network connectivity layer. Database-dependent applications become unreachable, user sessions drop, and business processes relying on database access halt. Recovery typically requires manual service restart, incurring downtime and operational overhead. Organizations running affected versions face repeated attack surface exposure unless patched, particularly in environments where the database server is exposed to untrusted networks.

Affected systems

Oracle Database Server versions 23.4.0 through 23.26.2 are confirmed vulnerable. Organizations should audit their database deployment inventory to identify systems within this version range. Other components of Oracle Database and other Oracle products are not mentioned as affected by this specific flaw.

Exploitability

This vulnerability is easily exploitable. An unauthenticated attacker requires only network access to the affected database server's TLS port—no valid database credentials, no special tooling, and no user interaction. The low attack complexity and absence of authentication requirements make this a straightforward attack vector for any adversary with basic network access to the target.

Remediation

Apply security patches issued by Oracle for CVE-2026-46835 to affected Oracle Database Server instances. Verify patch version compatibility and test in a non-production environment before production deployment. Organizations unable to patch immediately should implement network-level access controls to restrict connections to the database server's TLS port to trusted sources only, and monitor for signs of denial-of-service attacks.

Patch guidance

Contact Oracle for official patch advisories and version-specific updates addressing CVE-2026-46835 for Oracle Database Server 23.4.0–23.26.2. Patches should be applied in accordance with Oracle's change management and release notes. Schedule patching during maintenance windows to minimize downtime, and verify that post-patch database operations function as expected before restoring full production load.

Detection guidance

Monitor database server logs and network traffic for repeated TLS connection attempts followed by service crashes or hangs. Track process exit codes and service availability metrics for unexpected restarts. Implement network intrusion detection rules to identify suspicious patterns of connections to the database TLS port from external or untrusted sources. Alert on any correlation between failed connection attempts and service unavailability.

Why prioritize this

This vulnerability merits high priority due to its high CVSS score (7.5), ease of exploitation, lack of authentication requirements, and direct impact on service availability. Unlike vulnerabilities requiring user interaction or special privileges, this flaw is trivial to trigger and can be weaponized at scale by any attacker with network visibility to affected systems. Database availability is often critical to business continuity, making denial-of-service flaws in this component particularly disruptive.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a high-severity availability impact with a network attack vector, no authentication requirement, and low complexity. The score does not account for confidentiality or integrity breaches—only the ability to disrupt service. Organizations should consider context-specific risk factors: databases exposed to the internet warrant urgent remediation, while internal-only databases with strict network segmentation may allow a slightly longer remediation window.

Frequently asked questions