This vulnerability affects Oracle Net Services in Oracle Database Server versions 23.4.0 through 23.26.3. An unauthenticated attacker with network access via TCPS can exploit this flaw to cause Oracle Net Services to hang or crash repeatedly, resulting in a complete denial of service. Exploitation requires user interaction from a third party. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vendor advisory from Oracle confirms this vulnerability is addressed in their September 2026 Critical Security Patch Update, which includes numerous security fixes across Oracle products. Oracle strongly recommends applying these patches promptly.

Successful exploitation results in a denial of service condition by causing Oracle Net Services to hang or crash repeatedly, impacting availability. There is no confidentiality or integrity impact. The attack requires network access and user interaction from a third party. No known exploits in the wild have been reported. The vulnerability affects availability of Oracle Net Services in affected versions.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to mitigate the risk. The vendor advisory emphasizes remaining on actively supported versions and promptly applying security updates. No alternative mitigations or workarounds are specified in the advisory.