CVE-2026-83350

CVE-2026-83350 is an easily exploitable flaw in the Oracle Net Services component of Oracle Database Server, affecting supported releases 21.3-21.23 and 23.4.0-23.26.3. An unauthenticated attacker who can reach the database over the network via Oracle Net (typically the TNS listener on port 1521) can send crafted requests that cause the service to hang or crash repeatedly, resulting in a complete denial of service. There is no impact on confidentiality or integrity, but availability of the database listener is fully compromised. Any organization running the affected 21c or 23ai Database Server releases with Oracle Net reachable by untrusted parties is at risk. No public proof-of-concept is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw and move to a Database Server version outside the affected ranges (21.3-21.23 and 23.4.0-23.26.3). Restrict network access to Oracle Net listeners (default port 1521) so only trusted application servers and admins can connect, and enable valid-node checking at the listener. Watch for unexplained listener hangs or repeated crashes as an indicator of attempted exploitation.