Description
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows high privileged attacker having None privilege with logon to the infrastructure where Oracle Net Services executes to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 4.4 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service (Application Crash)
Action: Assess Impact
AI Analysis

Impact

Easily exploitable vulnerability in Oracle Net Services allows an attacker with high privileges on the local infrastructure to compromise the component. Successful exploitation can arbitrarily trigger a hang or a repeatedly crash, causing Oracle Net Services to become unavailable. The primary impact is loss of availability, with no direct effect on confidentiality or integrity. The weakness is best classified as a Denial of Service flaw involving improper handling of resource limits.

Affected Systems

Oracle Net Services component of Oracle Database Server, affecting versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3.

Risk and Exploitability

CVSS 3.1 base score of 4.4 indicates moderate severity, reflecting the high impact on availability when local privileges exist. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV, suggesting limited public exploitation data. The likely attack vector is local; an attacker must log on to the infrastructure where Oracle Net Services runs and possess high‑privilege access. Once executed, the attacker can force the service to crash, denying legitimate users access.

Generated by OpenCVE AI on October 21, 2026 at 05:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Net Services patch covering versions 19.3‑19.32, 21.3‑21.23, and 23.4.0‑23.26.3 from Oracle's security updates.
  • Temporarily stop or isolate Oracle Net Services to prevent service disruption while a patch is applied.
  • Enforce least‑privilege by restricting local users from having high‑level privileges that can access the Oracle Net Services process.

Generated by OpenCVE AI on October 21, 2026 at 05:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows high privileged attacker having None privilege with logon to the infrastructure where Oracle Net Services executes to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle net Services
CPEs cpe:2.3:a:oracle:net_services:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle net Services
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Net Services
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:16.286Z

Reserved: 2026-09-28T15:40:09.488Z

Link: CVE-2026-101510

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:00.240

Modified: 2026-10-20T22:18:00.240

Link: CVE-2026-101510

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T01:45:14Z

Weaknesses

No weakness.