Description
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the RDBMS executes to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The flaw resides in the RDBMS component of Oracle Database Server and permits any actor who can physically connect to the communication segment attached to the server's hardware to trigger a denial‑of‑service condition. The vulnerability is unauthenticated and grants the attacker the ability to cause the database to hang or repeatedly crash, which can lead to a complete interruption of service for all dependent applications. This impact is reflected in the CVSS 3.1 score of 6.5 that indicates a high level of availability damage.

Affected Systems

Oracle Corporation's Oracle Database Server versions 23.4.0 through 23.26.3 are affected. The issue applies to deployments where the RDBMS is operating on hardware that exposes a physical communication segment that could be accessed without authentication. Administrators should verify the exact build of the database server they are running.

Risk and Exploitability

The CVSS base score of 6.5 indicates a moderate to high severity, and the exploit requires local physical access rather than network reachability; the EPSS score is not available but the attack path is clearly defined, giving an experienced adversary a predictable means to disrupt the database. Because the flaw can be triggered without authentication, it could be used by anyone with physical proximity to the server, raising the overall risk especially in environments where the hardware is not fully secured. The vulnerability is not listed in the CISA KEV catalog at this time.

Generated by OpenCVE AI on October 21, 2026 at 12:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Oracle Database Server patch that addresses the denial of service flaw for the affected 23.x releases.
  • Restrict physical access to the server’s communication segment by implementing tamper‑evident enclosures or access control policies so that only authorized personnel can attach devices.
  • Configure monitoring on the RDBMS to detect abnormal hangs or crash events, and set up alerts so that incidents can be identified and remedied quickly.
  • If a patch is not yet available, consider disabling or removing the exposed physical interface on the hardware to eliminate the attack surface.

Generated by OpenCVE AI on October 21, 2026 at 12:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle database Server
Oracle Corporation
Oracle Corporation oracle Database Server
Vendors & Products Oracle database Server
Oracle Corporation
Oracle Corporation oracle Database Server

Wed, 21 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Physical Layer Exploit Allowing Denial of Service on Oracle Database Server
Weaknesses CWE-400
CWE-730

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the RDBMS executes to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle database - Rdbms
CPEs cpe:2.3:a:oracle:database_-_rdbms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle database - Rdbms
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Database - Rdbms Database Server
Oracle Corporation Oracle Database Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:19:30.401Z

Reserved: 2026-09-14T22:10:16.637Z

Link: CVE-2026-91479

cve-icon Vulnrichment

Updated: 2026-10-24T03:19:26.040Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:51.460

Modified: 2026-10-24T04:18:23.867

Link: CVE-2026-91479

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:00:16Z

Weaknesses