This vulnerability affects Oracle Net Services in Oracle Database Server versions 23.4.0 to 23.26.3. An unauthenticated attacker with network access can exploit this flaw to cause Oracle Net Services to hang or crash repeatedly, leading to a complete denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms that the attack requires no privileges or user interaction and impacts availability only. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security fixes across multiple products. Oracle strongly recommends applying the available patches promptly to mitigate this and other vulnerabilities.

Successful exploitation results in a complete denial of service of Oracle Net Services, causing the service to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability is exploitable remotely without authentication, increasing the risk of disruption to affected Oracle Database Server instances.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to remediate the issue. Staying on actively supported versions and promptly applying Oracle's security updates is critical to prevent exploitation. Patch status is confirmed by the vendor advisory, which details the availability of fixes in the update.