CVE-2026-47040: Oracle Net Services DOS Vulnerability

CVE-2026-47040 Overview

CVE-2026-47040 is a missing authentication vulnerability [CWE-306] in the Oracle Net Services component of Oracle Database Server. An unauthenticated attacker with network access via Oracle Net can compromise Oracle Net Services without user interaction. Successful exploitation grants unauthorized access to all Oracle Net Services accessible data and enables a complete denial-of-service condition through repeatable crashes or hangs.

Affected versions include Oracle Database Server 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Oracle addressed the flaw in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can extract sensitive data from Oracle Net Services and force complete denial of service against production database listeners.

Affected Products

Oracle Database Server 19.3 through 19.31
Oracle Database Server 21.3 through 21.22
Oracle Database Server 23.4.0 through 23.26.2

Discovery Timeline

2026-07-21 - CVE-2026-47040 published to NVD alongside the Oracle July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47040

Vulnerability Analysis

Oracle Net Services is the communication layer that brokers connections between clients and Oracle Database instances. The component handles session establishment, protocol negotiation, and data transport over the Oracle Net protocol, typically on TCP port 1521.

The vulnerability allows an unauthenticated remote attacker to interact with Oracle Net Services and reach functionality that should require authentication. Exploitation is described as low complexity, requires no privileges, and requires no user interaction. Impact covers both confidentiality and availability, exposing all data accessible to Oracle Net Services and enabling a complete, repeatable crash of the service.

The flaw does not affect integrity, but the combination of full data disclosure and reliable denial of service against a database listener creates severe operational risk for exposed instances.

Root Cause

The root cause is a missing authentication check on a critical function within Oracle Net Services [CWE-306]. Requests that should be gated by authentication are processed without verifying the identity of the caller. Oracle has not released public technical detail beyond the Critical Patch Update advisory.

Attack Vector

The attack vector is network-based over Oracle Net. An attacker with reachability to the database listener sends crafted Oracle Net traffic to trigger the vulnerable code path. No credentials, session, or prior foothold is required. See the Oracle Security Alert - July 2026 for the vendor advisory.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.486%.

Detection Methods for CVE-2026-47040

Indicators of Compromise

Unexpected crashes, restarts, or hangs of the TNS Listener (tnslsnr) process on Oracle Database hosts
Anomalous inbound connections to TCP port 1521 from untrusted or previously unseen source addresses
Spikes of malformed or truncated Oracle Net packets in listener.log
Repeated TNS- error entries indicating protocol violations or session drops

Detection Strategies

Enable and centrally forward the Oracle Net listener.log and sqlnet.log to a SIEM for correlation of protocol errors with source IP
Alert on repeated listener process terminations or ORA-00600 internal errors originating from network sessions
Deploy IDS/IPS signatures for anomalous Oracle Net (TNS) traffic patterns from outside authorized application tiers

Monitoring Recommendations

Baseline the set of hosts that legitimately initiate Oracle Net connections and alert on deviations
Monitor listener availability with synthetic checks so DoS attempts trigger immediate alerts
Correlate listener crashes with preceding network events to identify potential exploitation attempts

How to Mitigate CVE-2026-47040

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to all affected Database Server versions
Inventory Oracle Database instances and confirm versions against the affected ranges 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2
Restrict network access to the Oracle Net listener to authorized application and administrative hosts only
Prioritize patching internet-exposed or DMZ-facing database listeners first

Patch Information

Oracle released fixes as part of the Oracle Security Alert - July 2026 Critical Patch Update. Apply the Database Release Update that corresponds to your installed version. Restart the listener and database instance after patching to ensure the fix is loaded.

Workarounds

Enforce network-layer controls with firewalls or security groups so only trusted subnets can reach TCP port 1521
Configure sqlnet.oraTCP.VALIDNODE_CHECKING=YES with explicit TCP.INVITED_NODES allowlists to reject unauthorized clients
Place database listeners behind an Oracle Connection Manager (CMAN) or bastion layer that terminates untrusted traffic
Disable remote listener registration where not required to reduce the exposed surface

bash

# Example sqlnet.ora hardening to limit listener reachability
TCP.VALIDNODE_CHECKING = YES
TCP.INVITED_NODES = (10.10.20.15, 10.10.20.16, 10.10.30.0/24)
TCP.EXCLUDED_NODES = (0.0.0.0/0)

# Reload the listener after changes
lsnrctl reload