This vulnerability in Oracle Database Server's RDBMS component affects versions from 23.4.0 up to and including 23.26.3. It is exploitable remotely without authentication via Oracle Net, though it is considered difficult to exploit. The impact of successful exploitation includes complete compromise of the database server, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector with high attack complexity and no privileges or user interaction required. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can result in full takeover of the Oracle Database Server RDBMS, compromising confidentiality, integrity, and availability of the database. The vulnerability allows remote unauthenticated attackers with network access to Oracle Net to potentially execute this attack. The difficulty of exploitation is high, but the impact is severe if exploited.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the official Oracle patches promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are indicated in the vendor advisory.