CVE-2026-47046: Oracle Database RDBMS DOS Vulnerability

CVE-2026-47046 Overview

CVE-2026-47046 is a network-exploitable vulnerability in the Relational Database Management System (RDBMS) component of Oracle Database Server. Affected releases span versions 23.4.0 through 23.26.2. An unauthenticated attacker with network access via Oracle Net can trigger a hang or a repeatable crash of the RDBMS, producing a complete denial of service. The same flaw permits unauthorized update, insert, or delete operations against a subset of RDBMS-accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update. The weakness is categorized under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated remote attackers can crash Oracle Database instances and tamper with a subset of database contents over Oracle Net.

Affected Products

Oracle Database Server RDBMS component, version 23.4.0
Oracle Database Server RDBMS component, versions 23.5.0 through 23.26.1
Oracle Database Server RDBMS component, version 23.26.2

Discovery Timeline

2026-07-21 - CVE-2026-47046 published to the National Vulnerability Database
2026-07-21 - Oracle publishes the July 2026 Critical Patch Update advisory
2026-07-23 - CVE-2026-47046 last modified in the NVD database

Technical Details for CVE-2026-47046

Vulnerability Analysis

The defect resides in the RDBMS component that services client sessions arriving over Oracle Net. An unauthenticated attacker who can reach the listener can send crafted traffic that consumes or mismanages server-side resources. The result is either a hang or a repeatable crash of the database instance, which halts all connected workloads.

Beyond availability loss, the flaw exposes limited integrity impact. Successful exploitation allows unauthorized UPDATE, INSERT, or DELETE operations against some data reachable through the RDBMS. Confidentiality is not affected. The Exploit Prediction Scoring System places this issue at roughly the 20th percentile, indicating limited near-term exploitation signal at publication.

Root Cause

The underlying weakness is uncontrolled resource consumption ([CWE-400]) within the RDBMS request-handling path. The component fails to bound or validate certain inputs supplied over Oracle Net, allowing an attacker to force excessive resource use or an unrecoverable error state. The integrity impact indicates that the same code path also reaches write operations without adequate authorization enforcement for the affected data set.

Attack Vector

Exploitation requires only network reachability to the Oracle Net listener. No credentials and no user interaction are needed. The attacker sends malicious protocol traffic to the listening port, typically TCP 1521, and either exhausts server resources or drives the instance into a crash loop. Because the attack complexity is low, any exposed database instance running an affected 23ai release is reachable to any peer on the network path.

No public proof-of-concept exploit is listed in the enriched data. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-47046

Indicators of Compromise

Unexpected ORA- errors or instance crashes recorded in alert.log correlated with inbound Oracle Net sessions from untrusted sources.
Repeated short-lived TNS connections from a single source IP followed by listener or PMON restart events.
Unattributed UPDATE, INSERT, or DELETE activity in audit trails without a matching application session context.

Detection Strategies

Enable Unified Auditing for DML operations on sensitive schemas and alert on writes lacking an authenticated application user.
Monitor listener logs (listener.log) for high-volume connection attempts, malformed TNS packets, or repeated connection resets.
Correlate database instance restarts and SHUTDOWN ABORT events with concurrent network traffic spikes on port 1521.

Monitoring Recommendations

Forward Oracle alert, listener, and audit logs to a centralized analytics platform for cross-source correlation.
Track baseline connection rates per source IP to the Oracle Net listener and alert on deviations.
Watch for repeated instance recovery cycles, which indicate an active denial-of-service attempt against the RDBMS.

How to Mitigate CVE-2026-47046

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to every affected Oracle Database 23ai instance in the range 23.4.0 to 23.26.2.
Restrict network reachability to the Oracle Net listener so that only application servers and administrative hosts can connect.
Review audit trails for anomalous DML activity dating back to when affected releases were deployed.

Patch Information

Oracle released fixes for CVE-2026-47046 in the Oracle Security Alert July 2026. Administrators should identify affected 23ai deployments, stage the patch in a non-production environment, and then roll out the update following Oracle's documented patching procedure. Verify the patched version reports higher than 23.26.2 after installation.

Workarounds

Place the database listener behind a firewall or bastion so that only authorized application tiers can reach TCP 1521.
Configure Oracle Net VALID_NODE_CHECKING_REGISTRATION and TCP.INVITED_NODES in sqlnet.ora to restrict which hosts may establish sessions.
Enable database resource limits and connection rate limiting on network devices in front of the listener until the patch is applied.

bash

# Example sqlnet.ora hardening to restrict listener clients
TCP.VALIDNODE_CHECKING = YES
TCP.INVITED_NODES = (10.10.20.11, 10.10.20.12, 10.10.20.13)
TCP.EXCLUDED_NODES = (0.0.0.0/0)