CVE-2026-83160: Oracle Database RDBMS Privilege Escalation

CVE-2026-83160 Overview

CVE-2026-83160 is a high-severity vulnerability in the Relational Database Management System (RDBMS) component of Oracle Database Server. Affected releases include supported versions 23.4.0 through 23.26.3. A low-privileged attacker holding only the CREATE TABLE privilege can exploit the flaw remotely over Oracle Net. Successful exploitation results in complete takeover of the RDBMS instance, compromising confidentiality, integrity, and availability. Oracle published the fix in Security Alert CSPUSEP2026. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact
An authenticated attacker with minimal database privileges can achieve full RDBMS takeover across all Oracle Database 23ai releases from 23.4.0 through 23.26.3.

Affected Products

Oracle Database Server RDBMS component, version 23.4.0
Oracle Database Server RDBMS component, versions 23.5.0 through 23.25.x
Oracle Database Server RDBMS component, version 23.26.3

Discovery Timeline

2026-09-15 - CVE-2026-83160 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-83160

Vulnerability Analysis

The vulnerability resides in the RDBMS component of Oracle Database Server 23ai. It permits a database user with only the CREATE TABLE privilege to escalate control over the entire RDBMS instance. Because Oracle Net exposes the database to networked clients by default, the attack requires no local presence on the database host.

Oracle categorizes the outcome as full RDBMS takeover, indicating impacts to data confidentiality, data integrity, and service availability. The CWE-284 classification points to an access control weakness where privilege boundaries between low-privileged users and administrative RDBMS operations are not enforced correctly.

Root Cause

Oracle has not published low-level technical details. The CWE-284 mapping indicates that authorization checks fail to constrain what a CREATE TABLE-holding user can perform. Object creation logic appears to reach privileged code paths without validating that the caller is entitled to invoke them.

Attack Vector

The attacker authenticates to the Oracle Database listener over Oracle Net using any account provisioned with the CREATE TABLE system privilege. This privilege is routinely granted to application schema owners and developer accounts, widening the exposed attacker population. After authentication, the attacker issues crafted DDL or related operations to trigger the access-control failure and take over the RDBMS. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-supplied exploitation context.

Detection Methods for CVE-2026-83160

Indicators of Compromise

Unexpected grants of DBA, SYSDBA, or other administrative roles to accounts that previously held only CREATE TABLE.
New or modified SYS-owned objects, PL/SQL packages, or database triggers created by non-administrative schemas.
Anomalous CREATE TABLE, ALTER TABLE, or DDL bursts originating from application schemas or developer accounts.
Oracle Net sessions from unexpected source IPs authenticating to low-privileged accounts followed by privileged operations.

Detection Strategies

Enable Oracle Unified Auditing for DDL, role grant, and privilege escalation events, and forward logs to a centralized SIEM.
Baseline the set of accounts holding CREATE TABLE and alert on any of these accounts performing privileged operations or accessing SYS objects.
Correlate listener logs with database audit records to identify remote sessions that transition from low-privileged activity to administrative actions.

Monitoring Recommendations

Continuously monitor DBA_ROLE_PRIVS, DBA_SYS_PRIVS, and DBA_TAB_PRIVS for unauthorized changes.
Watch for creation of new PL/SQL objects with AUTHID DEFINER compiled under privileged schemas.
Alert on failed and successful login patterns to Oracle Net listeners from non-application hosts.

How to Mitigate CVE-2026-83160

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to all Oracle Database 23ai instances between 23.4.0 and 23.26.3.
Inventory every account holding the CREATE TABLE privilege and revoke it from users that do not require it.
Restrict Oracle Net listener access to trusted application subnets using network ACLs or sqlnet.ora valid node checking.
Rotate credentials for accounts that may have been used for testing or shared across environments.

Patch Information

Oracle addressed CVE-2026-83160 in Security Alert CSPUSEP2026. Administrators should download the corresponding Release Update or one-off patch for their exact 23ai version from My Oracle Support and apply it using OPatch, followed by datapatch to update database dictionary metadata. Verify the fix by confirming the patch registration in DBA_REGISTRY_SQLPATCH.

Workarounds

Revoke the CREATE TABLE privilege from all non-essential users until the patch is applied.
Enforce Oracle Net access controls via tcp.invited_nodes in sqlnet.ora to limit which hosts can reach the listener.
Enable Oracle Database Vault or equivalent controls to segregate privileged operations from application schemas where feasible.

bash

# Configuration example: restrict Oracle Net access and audit DDL activity
# In $ORACLE_HOME/network/admin/sqlnet.ora
tcp.validnode_checking = yes
tcp.invited_nodes = (app-host-1, app-host-2, 10.20.30.0/24)

# Enable unified auditing for DDL and privilege changes
SQL> CREATE AUDIT POLICY ddl_priv_policy
     ACTIONS CREATE TABLE, ALTER TABLE, GRANT, ALTER USER;
SQL> AUDIT POLICY ddl_priv_policy;