CVE-2026-83348 is a vulnerability in the Oracle Database Server's RDBMS component that affects supported versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. The flaw allows an attacker with low privileges (specifically, the Create DB Link privilege) and network access through Oracle Net to compromise the database server. The vulnerability can lead to complete takeover of the RDBMS, impacting confidentiality, integrity, and availability. Oracle has addressed this issue in their September 2026 Critical Security Patch Update, which includes 673 security fixes across multiple products. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can result in an attacker gaining full control over the Oracle Database Server, compromising confidentiality, integrity, and availability of the database. The attacker requires only low privileges (Create DB Link) and network access, making the vulnerability easily exploitable. This poses a significant risk to organizations using affected Oracle Database versions if patches are not applied.

Oracle has released official patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply these security patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security updates without delay to prevent exploitation. No alternative mitigations are specified in the advisory.