CVE-2026-83351

CVE-2026-83351 is a difficult-to-exploit vulnerability in the core RDBMS component of Oracle Database Server, affecting supported releases 23.4.0 through 23.26.3. An unauthenticated attacker with network reachability to the database's Oracle Net (TNS) listener — with no privileges and no user interaction required — can exploit the flaw and take over the RDBMS, gaining full impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). The high attack-complexity rating (AC:H) means reliable exploitation likely requires significant skill or favorable conditions, somewhat lowering practical risk. Any organization running an affected 23.x Oracle Database Server release that is reachable over the network is in scope, though database servers exposed directly to the internet face the greatest risk. There is no public proof of concept and the CVE is not on the CISA KEV list, so no exploitation is currently known.

What to do: Apply the Oracle Critical Patch Update containing the fix for CVE-2026-83351, moving any 23.4.0-23.26.3 database to the patched release. Restrict Oracle Net/TNS listener (TCP 1521 and any configured listener ports) so it is reachable only from trusted application and admin hosts — it should never be directly exposed to the internet. Verify listener configuration, enable TNS authentication/encryption controls, and review database and listener logs for unexpected connection attempts while patching is scheduled.