CVE-2026-83347: Oracle Net Services DOS Vulnerability

CVE-2026-83347 Overview

CVE-2026-83347 is a denial-of-service vulnerability in the Oracle Net Services component of Oracle Database Server. The flaw affects supported versions 23.4.0 through 23.26.3. An unauthenticated attacker with network access over TCPS can exploit this issue to cause a hang or repeatable crash of Oracle Net Services, resulting in complete loss of database connectivity.

Successful exploitation requires human interaction from a user other than the attacker. The vulnerability impacts availability only and does not affect confidentiality or integrity.

Critical Impact
Remote unauthenticated attackers can trigger a complete denial of service against Oracle Net Services over TCPS, disrupting all database client connectivity.

Affected Products

Oracle Database Server 23.4.0
Oracle Database Server versions 23.5.0 through 23.26.2
Oracle Database Server 23.26.3

Discovery Timeline

2026-09-15 - CVE CVE-2026-83347 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83347

Vulnerability Analysis

The vulnerability resides in Oracle Net Services, the communication layer that handles client-to-database connectivity for Oracle Database Server. The flaw is triggered over TCPS, the TLS-wrapped Oracle Net transport used for encrypted client sessions.

Because exploitation requires no authentication and no elevated privileges, any network-reachable Oracle Net listener endpoint accepting TCPS traffic is exposed. The user interaction requirement suggests a client-side condition contributes to the crash sequence, possibly during connection negotiation or certificate handling.

Successful exploitation produces either a hang or a repeatable crash of Oracle Net Services, yielding complete denial of service. Confidentiality and integrity are not affected, and no data disclosure or code execution occurs.

Root Cause

Oracle has not disclosed the underlying defect. Based on the CVSS metrics and the TCPS-specific attack surface, the root cause is an unhandled condition in the network protocol handling logic that terminates or hangs the listener process when a malformed sequence is processed alongside a legitimate client action.

Attack Vector

The attack originates from the network over TCPS. An attacker sends crafted traffic to the Oracle Net Services listener. A separate user must perform an action that contributes to triggering the fault condition. Once triggered, Oracle Net Services enters a hang state or crashes, and the condition is frequently repeatable, allowing sustained denial of service. Refer to the Oracle Security Alert CSPUSEP2026 for technical guidance.

Detection Methods for CVE-2026-83347

Indicators of Compromise

Repeated Oracle Net listener restarts or unexpected TNS-12 series errors in listener.log.
Client connections over TCPS terminating during handshake or session initiation.
Sudden loss of database availability correlated with inbound TCPS traffic from unfamiliar source IPs.
Elevated volume of malformed or truncated TLS handshakes targeting the listener port.

Detection Strategies

Monitor Oracle Net Services process health and correlate crash events with inbound network flows on the TCPS port.
Inspect listener.log and alert.log for recurring protocol errors preceding service outages.
Deploy network intrusion detection signatures for anomalous Oracle Net protocol sequences over TLS.

Monitoring Recommendations

Alert on Oracle Net listener process termination or unresponsiveness.
Track connection failure rates on TCPS endpoints and baseline normal client behavior.
Log source IP addresses of failed TCPS handshakes to identify probing activity.

How to Mitigate CVE-2026-83347

Immediate Actions Required

Apply the Oracle patch referenced in Oracle Security Alert CSPUSEP2026 as soon as feasible.
Restrict TCPS listener exposure to trusted client networks using firewall rules or Oracle Net access control lists.
Inventory all Oracle Database Server 23.4.0 through 23.26.3 instances to confirm patch scope.

Patch Information

Oracle released a fix as part of the CSPUSEP2026 security alert. Administrators should consult the Oracle Security Alert CSPUSEP2026 for the specific patch bundle, version mapping, and installation instructions applicable to their deployment.

Workarounds

Limit TCPS listener accessibility to known client subnets via network segmentation.
Configure sqlnet.oraTCP.INVITED_NODES and TCP.EXCLUDED_NODES to enforce IP-based access restrictions on Oracle Net.
Enable Oracle Net connection rate limiting to reduce the effectiveness of repeated exploitation attempts.

bash

# Configuration example: restrict Oracle Net access via sqlnet.ora
tcp.validnode_checking = yes
tcp.invited_nodes = (192.0.2.10, 192.0.2.11, 10.0.0.0/24)
tcp.excluded_nodes = (0.0.0.0/0)