The flaw resides in the Net Service component of Oracle Database Server, allowing an unauthenticated attacker with TLS‑layer network access to compromise the service. This is an authentication and access control weakness (CWE‑285, CWE‑284). Successful exploitation would result in full takeover of Net Service, giving the attacker unauthorized control over database operations. The vulnerability changes scope, potentially impacting additional products, and is rated CVSS 3.1 base score 9.0, indicating severe impact on confidentiality, integrity, and availability.

All supported Oracle Database Server releases from version 23.4.0 through 23.26.2 are impacted. The vulnerability specifically targets the Net Service component, which is used for client connections.

The CVSS score of 9.0 reflects critical risk. The attack vector requires network‑based access over TLS, which is commonly available in customer environments. Because the incident is unauthenticated and only requires connectivity to the Net Service port, an attacker can launch the exploit from any external network without needing credentials. The EPSS score of < 1% indicates that the likelihood of active exploitation is very low. There is no publicly documented exploit at this time, and the vulnerability is not listed in CISA KEV, but the high severity and the potential for scope change demand immediate attention from database administrators.