CVE-2026-83350 Overview
CVE-2026-83350 is a denial of service vulnerability in the Oracle Net Services component of Oracle Database Server. The flaw affects Oracle Database versions 21.3 through 21.23 and 23.4.0 through 23.26.3. An unauthenticated remote attacker with network access via Oracle Net can trigger a hang or repeatable crash of Oracle Net Services. The vulnerability is categorized under [CWE-400: Uncontrolled Resource Consumption]. Oracle addressed the issue in a security alert published in September 2026.
Critical Impact
Successful exploitation results in a complete denial of service of Oracle Net Services, disrupting database connectivity for all dependent applications.
Affected Products
- Oracle Database Server versions 21.3 through 21.23
- Oracle Database Server versions 23.4.0 through 23.26.3
- Oracle Net Services component
Discovery Timeline
- 2026-09-15 - CVE-2026-83350 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-83350
Vulnerability Analysis
The vulnerability resides in Oracle Net Services, the networking layer that manages client-server communication with the Oracle Database Server. An unauthenticated attacker with network reachability to the listener can send crafted traffic over Oracle Net to induce a hang or a repeatable crash. Because the attack does not require credentials or user interaction, any exposed listener endpoint represents a viable target.
The impact is scoped entirely to availability. Confidentiality and integrity of database contents are not affected, but the service disruption cascades to every application that depends on the affected database instance for connectivity.
Root Cause
The root cause maps to [CWE-400: Uncontrolled Resource Consumption]. Oracle's advisory does not disclose implementation-level details, but the classification indicates that specific network input drives Oracle Net Services into a state where resources are exhausted or the process terminates abnormally. Repeated delivery of the trigger produces a complete denial of service.
Attack Vector
Exploitation requires network access to the Oracle Net listener port, typically TCP 1521. The attacker sends malicious Oracle Net protocol messages to the listener without authenticating. No user interaction is involved, and the attack complexity is low. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical context.
No public proof-of-concept exploit is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is approximately 0.46%.
Detection Methods for CVE-2026-83350
Indicators of Compromise
- Unexpected TNS-12500, TNS-12518, or TNS-12560 errors in listener logs
- Repeated listener process crashes or restarts recorded in listener.log and alert logs
- Sudden loss of client connectivity coinciding with anomalous inbound traffic to TCP 1521
Detection Strategies
- Monitor Oracle listener logs for abnormal termination patterns and connection anomalies from a single source
- Deploy network intrusion detection signatures for malformed Oracle Net (TNS) protocol traffic
- Correlate listener restarts with inbound connection spikes to identify probing behavior
Monitoring Recommendations
- Alert on listener process availability using database monitoring tooling and health checks
- Track connection failure rates and packet-level anomalies at network sensors positioned in front of database subnets
- Ingest Oracle audit and listener logs into a centralized analytics platform for baseline deviation analysis
How to Mitigate CVE-2026-83350
Immediate Actions Required
- Apply the patches distributed in the Oracle Security Alert CSPUSEP2026 to all affected Oracle Database Server instances
- Restrict network access to the Oracle Net listener so only authorized application servers can reach TCP 1521
- Review listener logs for prior indicators of exploitation attempts against exposed database endpoints
Patch Information
Oracle released fixes as part of the CSPUSEP2026 security alert. Administrators should upgrade Oracle Database Server 21.x to a version beyond 21.23 and 23.x to a version beyond 23.26.3 in line with Oracle's patch bundle guidance. Confirm patch levels using SELECT * FROM DBA_REGISTRY_SQLPATCH; after installation.
Workarounds
- Enforce Oracle Net access control lists via sqlnet.ora using TCP.VALIDNODE_CHECKING and TCP.INVITED_NODES to restrict source IPs
- Place database listeners behind firewalls or private network segments that block direct internet exposure
- Deploy rate limiting and anomaly-based filtering in front of listener endpoints where feasible
# Configuration example: restrict listener access in sqlnet.ora
TCP.VALIDNODE_CHECKING = YES
TCP.INVITED_NODES = (10.0.1.10, 10.0.1.11, 10.0.1.12)
TCP.EXCLUDED_NODES = (0.0.0.0/0)
# Reload the listener to apply changes
lsnrctl reload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
