PatchSiren cyber security CVE debrief

CVE-2026-46834 Oracle Corporation CVE debrief

A high-severity vulnerability in Oracle Database Server's Net Service component allows unauthenticated remote attackers to cause a complete denial of service (DoS) via TLS. The vulnerability affects Oracle Database Server versions 23.4.0 through 23.26.2. With a CVSS 3.1 score of 7.5, this vulnerability is easily exploitable by network-based attackers without authentication, requiring no user interaction. Successful exploitation results in unauthorized ability to cause a hang or frequently repeatable crash of Net Service, impacting availability only. The vulnerability was disclosed by Oracle in their May 2026 Critical Patch Update.

Vendor: Oracle Corporation
Product: Oracle Database Server
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-05-29
Advisory published: 2026-05-28
Advisory updated: 2026-05-29

Who should care

Organizations running Oracle Database Server 23.4.0-23.26.2 with externally accessible Net Service listeners, particularly those exposed to untrusted networks. Database administrators and security teams responsible for Oracle infrastructure availability should prioritize patching.

Technical summary

The vulnerability exists in the Net Service component of Oracle Database Server versions 23.4.0 through 23.26.2. An unauthenticated attacker with network access can exploit this flaw via TLS connections to cause a complete denial of service. The attack vector is network-based with low attack complexity, requiring no privileges or user interaction. The vulnerability results in high availability impact (complete DoS) with no confidentiality or integrity impact.

Defensive priority

high

Recommended defensive actions

Apply Oracle Critical Patch Update (CPU) for May 2026 as soon as testing permits, prioritizing externally accessible database instances
Restrict network access to Oracle Database Net Service listeners to authorized hosts and networks where possible
Monitor for unusual TLS connection patterns or connection attempts that may indicate exploitation attempts
Review Oracle security alert for patch availability and additional mitigation guidance
Consider implementing TLS inspection or rate limiting at network boundaries to reduce exposure

Evidence notes

Vulnerability description sourced from official NVD record. Vendor attribution to Oracle based on reference domain evidence and Oracle security alert reference. Affected product versions and CVSS metrics confirmed from NVD data.

Official resources

Oracle disclosed this vulnerability on 2026-05-28 as part of their Critical Patch Update security advisory. The CVE was published to NVD on the same date with vulnerability status 'Received'.