CVE-2026-83348

The core RDBMS component of Oracle Database Server contains an easily exploitable privilege escalation flaw (CVSS 3.1: 8.8) affecting supported releases 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. It is triggered remotely over Oracle Net by a low-privileged database user who holds the CREATE DATABASE LINK privilege, abusing database-link functionality to execute code with elevated privileges. Successful exploitation results in a complete takeover of the RDBMS, with high impact on confidentiality, integrity, and availability. Any organization running the affected supported versions is exposed, whether the listener is internet-facing or only reachable by insiders and compromised credentials on the internal network. No public proof-of-concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation is known.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw; based on the stated affected ranges, the fix first appears in the releases just beyond them (19.33+, 21.24+, 23.27+ or later). Until patched, restrict Oracle Net listener ports (TCP 1521/2484) at the firewall so only application servers and DBA hosts can reach them. Audit which low-privilege accounts hold the CREATE DATABASE LINK privilege, revoke it where unneeded, and monitor for unexpected database link creation as a sign of exploitation attempts.