Introduction
An unauthenticated attacker who can reach an Oracle Database TLS listener can now cause a complete hang or repeatable crash of the Net Service component, which cuts off all database connectivity for affected deployments. Oracle Database has over 37,000 enterprise customers globally, and the affected version range covers the entire 23ai release family. That makes this vulnerability an operational concern for any organization that depends on Oracle for critical workloads.
Technical information
CVE-2026-46834 is in the Net Service component of Oracle Database Server. Net Service is Oracle's networking infrastructure. It manages all client-to-server communication, including TLS-encrypted connections. An unauthenticated attacker with network access via TLS can cause a hang or frequently repeatable crash of Net Service, which amounts to a complete denial of service.
CVSS 3.1 vector analysis
The vulnerability scores 7.5 on CVSS 3.1 with the vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H):
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely |
| Attack Complexity | Low | No specialized conditions required |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No user action required |
| Scope | Unchanged | Impact confined to Net Service |
| Confidentiality | None | No data disclosure |
| Integrity | None | No data modification |
| Availability | High | Complete denial of service |
A network attack vector, low complexity, and no authentication requirement make this vulnerability straightforward to reach. Any attacker who can open a TLS connection to the Oracle Database listener port (typically 1521 or a configured TLS port) could trigger the denial of service.
Attack surface: TLS as the entry point
The attack arrives over TLS, the encrypted channel that Oracle Net Service uses. Because the traffic is encrypted, traditional network security controls such as deep packet inspection cannot inspect its contents, which limits how well network-based defenses can detect or block exploitation attempts. The attacker needs only network-level access and the ability to start a TLS handshake with the listener.
Root cause and technical mechanism
The mechanism that triggers the denial of service has not been publicly disclosed. Oracle does not publish vulnerability details that could help attackers, and the NVD record is currently marked "Awaiting Enrichment", with no CWE ID assigned and no CVSS 4.0 assessment available. It is not yet known whether the flaw involves resource exhaustion, a protocol parsing error, a malformed TLS handshake, or some other vector.
The companion vulnerability: CVE-2026-46833
CVE-2026-46834 should not be read in isolation. The May 2026 CSPU also addresses CVE-2026-46833, which targets the same component (Net Service), the same protocol (TLS), and the same version range (23.4.0 through 23.26.2). CVE-2026-46833, however, carries a CVSS 3.1 score of 9.0 with high confidentiality, integrity, and availability impacts, so it could enable full database compromise rather than just service disruption.
| CVE ID | Component | Protocol | CVSS 3.1 | Impact |
|---|---|---|---|---|
| CVE-2026-46833 | Net Service | TLS | 9.0 | High C/I/A |
| CVE-2026-46834 | Net Service | TLS | 7.5 | High A only |
HexRabbit of the DEVCORE Research Team reported CVE-2026-46833. Together, the two vulnerabilities form a layered threat through the same network path. CVE-2026-46834 enables reliable service disruption, and CVE-2026-46833 could enable data exfiltration and corruption. Patching one and leaving the other unaddressed still leaves significant exposure. The Oracle CSPU fixes both in a single patch bundle.
Oracle's new monthly patch cadence
Oracle disclosed this vulnerability in its first monthly Critical Security Patch Update (CSPU), which replaces the previous quarterly Critical Patch Update cycle. The May 2026 CSPU contains 35 new security patches across multiple product families. The April 2026 CPU, the last quarterly release, contained 8 new security patches for Oracle Database Products, and 4 of them were remotely exploitable without authentication. Organizations now have to adapt their patch management processes to a monthly cadence.
Affected systems and versions
The vulnerability affects Oracle Database Server versions 23.4.0 through 23.26.2. That range covers the entire Oracle Database 23ai (23c) release family.
Oracle Database 19c, which remains under Long Term Support, does not appear in the affected version range.
The vulnerability targets the Net Service component when TLS-encrypted connections are in use. Deployments that do not expose TLS-enabled Net Service listeners to untrusted networks have a reduced (but not eliminated) attack surface.
Vendor security history
Oracle's security track record has drawn significant scrutiny in recent years. In Q1 2025, a threat actor known as "rose87168" posted approximately 6 million data records for sale on BreachForums and claimed access to Oracle's traditional servers. CybelAngel's investigation found that an attacker had installed a webshell and additional malware on Oracle's Gen 1 servers (Oracle Cloud Classic) as early as January 2025 and stole data from the Oracle Identity Manager database for approximately two months. CloudSEK identified the compromised credential data as belonging to more than 140,000 Oracle cloud tenants.
Oracle confirmed that a hacker accessed two outdated servers, which it described as "never part of OCI." Cybersecurity expert Kevin Beaumont criticized this response as a "play on words." He noted that the affected Oracle Classic services are still Oracle-managed cloud services. In a separate incident, the Oracle Health data breach may have affected up to 80 hospitals, and at least 14,485 individuals are confirmed impacted.
This history shows that threat actors actively target Oracle infrastructure, and that Oracle's disclosure practices have been criticized for minimizing the scope of security incidents. Both points argue for patching promptly rather than relying on workarounds or delaying the response.
References
- NVD Entry for CVE-2026-46834
- Oracle Security Critical Patch Update Advisory, May 2026
- Oracle Critical Patch Updates and Security Alerts
- Oracle Critical Patch Update Advisory, April 2026
- Oracle Critical Patch Update Advisory, January 2026
- CISA Known Exploited Vulnerabilities Catalog
- January 2026 CVE Landscape: 23 Critical Vulnerabilities, Recorded Future
- Oracle confirms data breach via outdated servers, Techzine
- Oracle Appears to Admit Breach of 2 'Obsolete' Servers, Dark Reading
- 80 Hospitals May Have Been Affected by the Oracle Health Data Breach, HIPAA Journal
- Enterprise Database Market Research Report 2034, Dataintelo
- Best Relational Databases Software in 2026, 6sense
- Oracle Corporation Company Profile, IBISWorld
