CVE-2026-83349: Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. in Oracle Corporation Oracle Database Server
A vulnerability exists in the Oracle Net Services component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. This vulnerability allows an unauthenticated attacker with network access to cause a denial of service by hanging or crashing Oracle Net Services. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a high severity with impact on availability only. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update.
AI Analysis
Technical Summary
CVE-2026-83349 is a vulnerability in Oracle Net Services within Oracle Database Server versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. It allows an unauthenticated attacker with network access via Oracle Net to cause a hang or repeated crash, resulting in a denial of service condition. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability along with many others.
Potential Impact
Successful exploitation results in denial of service by causing Oracle Net Services to hang or crash repeatedly. There is no confidentiality or integrity impact reported. The vulnerability is easily exploitable remotely without authentication.
Mitigation Recommendations
Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.
CVE-2026-83349: Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. in Oracle Corporation Oracle Database Server
Description
A vulnerability exists in the Oracle Net Services component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. This vulnerability allows an unauthenticated attacker with network access to cause a denial of service by hanging or crashing Oracle Net Services. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a high severity with impact on availability only. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-83349 is a vulnerability in Oracle Net Services within Oracle Database Server versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. It allows an unauthenticated attacker with network access via Oracle Net to cause a hang or repeated crash, resulting in a denial of service condition. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability along with many others.
Potential Impact
Successful exploitation results in denial of service by causing Oracle Net Services to hang or crash repeatedly. There is no confidentiality or integrity impact reported. The vulnerability is easily exploitable remotely without authentication.
Mitigation Recommendations
Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j7mc-c894-qw7h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-83349"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa07dc55bf5e2cf5ea328d
Added to database: 09/16/2026, 03:07:08 UTC
Last enriched: 09/16/2026, 03:54:03 UTC
Last updated: 09/16/2026, 05:01:22 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.