CVE-2026-46833
A critical vulnerability exists in the Net Service component of Oracle Database Server versions 23.4.0 through 23.26.2. An unauthenticated attacker who can reach the server over TLS can take control of Net Service, potentially affecting other Oracle products. The flaw can lead to full compromise of confidentiality, integrity, and availability.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Database Server, versions 23.4.0 to 23.26.2, used by organizations that expose the database to network traffic.
Real-world impact
An attacker could take over the Net Service component, giving them full control over the database server, allowing them to read, modify, or delete data, and potentially disrupt or deny service to legitimate users.
Why this severity
The CVSS score of 9.0 reflects that the vulnerability is exploitable from the network, requires no authentication, and has a high impact on confidentiality, integrity, and availability. The high attack complexity and the scope change mean that a successful exploit can affect other components beyond Net Service.
What to do about it
- ›Restrict network access to the Oracle Database Server so that only trusted hosts can reach it over TLS.
- ›Monitor and block suspicious TLS traffic to the Net Service component.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.
Timeline
- May 28, 2026 · May 28, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- oracle.com/security-alerts/cspumay2026…vendor advisory