CVE-2026-83347

Executive Summary

CVE-2026-83347 is an unauthenticated, network-reachable denial-of-service vulnerability affecting the Oracle Net Services component of Oracle Database Server, across supported versions 23.4.0 through 23.26.3. An attacker with network access to the TCPS listener can, with low attack complexity but requiring human interaction from a person other than the attacker, trigger a hang or frequently repeatable crash of Oracle Net Services, resulting in complete denial of service (Availability impact: High). No public proof-of-concept, exploit code, or CISA KEV listing exists at time of writing, and no patch has been published.

Technical Analysis

Oracle Net Services is the networking layer of Oracle Database Server responsible for establishing and maintaining client-to-database connections. It encompasses the listener, the TCPS (TLS/SSL-secured TCP) protocol endpoint, connection negotiation, and session establishment. In the affected version range (23.4.0–23.26.3), a flaw within this component permits an unauthenticated remote party with network access to the TCPS interface to force the service into a hang or repeatedly trigger a crash.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H characterizes the flaw precisely:

• AV:N — the attack is launched over the network; the TCPS listener must be reachable from the attacker's position.
• AC:L — no special conditions or race windows are required.
• PR:N — no authentication is needed; the attacker does not require valid database credentials.
• UI:R — the attack requires interaction from a person other than the attacker. This is the distinguishing characteristic: exploitation is not fully autonomous. The human interaction is most plausibly a legitimate user or administrator performing a routine Net Services action (for example, establishing a connection or negotiating a session) that, combined with attacker-supplied network traffic, triggers the adverse state.
• S:U — the impact is confined to the Oracle Net Services security scope.
• C:N/I:N — no confidentiality or integrity impact. This is a pure availability attack.
• A:H — total loss of availability of Oracle Net Services.

Because no CWE is assigned and the description does not disclose the internal implementation, the precise defect cannot be named. The classification that best fits the observable behavior — an unauthenticated hang or repeatable crash — is CWE-400 (Uncontrolled Resource Consumption), where malformed or unexpected TCPS traffic induces resource exhaustion or a fatal fault condition in the connection-handling path. The mechanism may alternatively relate to improper input validation (CWE-20) or a null-pointer/dereference fault surfacing as a crash, but the source data does not permit a definitive determination. No function names, packet structures, or protocol-level details are available and none are asserted here.

Critically, the UI:R component means this is not a self-contained unaided flood: the attacker's crafted traffic must coincide with a legitimate, human-initiated action. This raises the practical bar for a mass-exploitation worm while leaving the flaw "easily exploitable" for a targeted or socially-adjacent attack (for example, tricking or timing activity against a legitimate user).

Patch confidence is 0/4 — there is no evidence of a vendor fix, workaround, or advisory from any tracked source. The exposure window is therefore open-ended as of this report.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred strictly from the vulnerability class (unauthenticated availability impact over TCPS with required human interaction) and the CVSS vector. No specific function names, endpoints, or payload structures are asserted because the source description does not provide them.

1. Reconnaissance / target identification. The attacker scans for internet- or network-exposed Oracle Database Server TCPS listeners (typically TLS-wrapped Oracle Net, distinct from the plaintext listener port). Version fingerprinting against the 23.4.0–23.26.3 range confirms a potentially vulnerable target. Shodan/Censys queries for Oracle Database exposure and TCPS service banners support this step.

2. Triggering the flaw class. The attacker transmits crafted traffic to the TCPS endpoint. Because the vector specifies PR:N, no credentials are required to reach the vulnerable state. Because it specifies UI:R, the adverse outcome depends on a legitimate party (a user or administrator other than the attacker) performing a Net Services action in conjunction with the attacker's traffic — for example, initiating or negotiating a connection at the moment the crafted traffic is present. The exact packet-level trigger is not disclosed.

3. Payload / execution method (class level). At the vulnerability-class level, this is an availability attack: malformed or unexpected network input to the Net Services connection path induces either resource exhaustion or a fault leading to a hang or crash. No code execution, memory corruption exploitation, or data exfiltration is involved (C:N/I:N, S:U). The attacker needs only the ability to send traffic to the reachable TCPS interface.

4. Post-exploitation impact. Successful triggering results in a hang or frequently repeatable crash of Oracle Net Services — a complete denial of service (A:H). Because "frequently repeatable" is specified, the attacker can sustain the outage by re-triggering it, preventing recovery for as long as traffic can be delivered.

No confirmed in-the-wild exploitation, campaign attribution, or KEV addition exists in the provided data. EPSS 0.00355 (29.0th percentile) indicates low predicted near-term exploitation activity.

Impact Assessment

The blast radius is defined by the reachability and criticality of the affected Oracle Net Services listener. Disruption or crash of Oracle Net Services severs database connectivity for all dependent clients and applications — effectively a full availability outage for every workload routing through that listener, even though the database engine's confidentiality and integrity remain intact.

Business impact centers on service downtime: transaction processing, application back-ends, reporting, and any dependent middleware fail when the Net Services layer is unavailable. In regulated or high-availability environments, sustained unavailability of a database listener can violate RTO/MTTR commitments and trigger SLA breaches.

CVSS subscores reinforce the profile: Availability is High, while Confidentiality and Integrity are None, and Scope is Unchanged (S:U). The high Availability subscore of 6.5 reflects real operational disruption, while the unchanged scope and absent C/I impact bound the consequence to denial of service rather than data compromise. The UI:R requirement moderates likelihood against fully autonomous exploitation, but the AC:L and PR:N factors keep the flaw "easily exploitable" once network access and the required legitimate interaction are achieved.

Exposed installations on the public internet carry the greatest risk; internal-only listeners face a reduced but non-zero threat from insider or lateral-movement scenarios.

Detection Guidance

Sigma Rule

title: Potential Oracle Net Services DoS Attempt (CVE-2026-83347)
id: 7c3f9b21-4e6a-4d18-9a55-0f1e2c8b3d47
status: experimental
description: Detects anomalous connection/reset activity against Oracle Net Services TLS listener potentially related to availability attacks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-83347
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 2484
    Initiated: 'true'
  timeframe: 5m
  condition: selection | count() by SourceIp > 50
falsepositives:
  - Legitimate connection storms from application pools (tune threshold)
level: medium
tags:
  - attack.t1499
  - cve.2026.83347

YARA Rule

rule CVE_2026_83347_Oracle_Net_Services_DoS_Indicator
{
    meta:
        description = "Detection heuristic for traffic patterns associated with Oracle Net Services availability attacks (CVE-2026-83347). Generic TCPS/Oracle Net markers - tune to environment."
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83347"
        cve = "CVE-2026-83347"

    strings:
        $oracle_net = "(DESCRIPTION=" ascii nocase
        $oracle_addr = "(ADDRESS=" ascii nocase
        $oracle_proto = "(PROTOCOL=TCPS" ascii nocase
        $oracle_conn = "(CONNECT_DATA=" ascii nocase

    condition:
        uint16(0) == 0x1603 or any of ($oracle_*)
}

Note: YARA is host/file-oriented; this rule targets Oracle Net connect-descriptor strings that may appear in captured artifacts or memory. Network-level detection is better served by the Suricata rule below.

Suricata IDS Rule

alert tcp any any -> any 2484 (msg:"CVE-2026-83347 Oracle Net Services TCPS potential DoS activity"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|03|"; offset:3; depth:1; content:"(DESCRIPTION="; nocase; content:"(CONNECT_DATA="; nocase; threshold:type both, track by_src, count 50, seconds 60; classtype:attempted-dos; reference:cve,2026-83347; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-83347; sid:202683347; rev:1;)

This rule flags high-rate TLS-wrapped Oracle Net connect-descriptor traffic to the Net Services port; the threshold must be tuned, as the exact trigger signature is not published.

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where destination.port == 2484 and network.transport == "tcp"]
  [network where destination.port == 2484 and network.transport == "tcp"]
  [network where destination.port == 2484 and network.transport == "tcp"]

Interpretation: repeated client connection cycles to the TCPS Net Services port within a short window, indicating potential repeatable-crash attempts per CVE-2026-83347.

Splunk SPL Query

index=network (dest_port=2484 OR dest_port=1521)
| bin _time span=1m
| stats count AS conn_attempts dc(src_ip) AS unique_sources values(action) AS actions BY src_ip dest_ip dest_port _time
| where conn_attempts > 50
| eval cve="CVE-2026-83347", severity="medium"
| table _time src_ip dest_ip dest_port conn_attempts unique_sources cve severity
| sort - conn_attempts

Tune the conn_attempts threshold and port list (1521 plaintext, 2484 TCPS) to your environment.

Wazuh OSSEC Rule

<group name="oracle,attack,dos,">
  <rule id="100347" level="10">
    <decoded_as>json</decoded_as>
    <field name="dest_port">2484</field>
    <description>CVE-2026-83347: High-rate connection activity to Oracle Net Services TCPS port (possible DoS attempt)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,oracle,</group>
  </rule>
</group>

Requires a syslog/firewall decoder mapping dest_port; adapt field names to the ingestion schema in use.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is published in the provided data.

1. Immediate mitigations.

   • Restrict network reachability to the Oracle Net Services listener (default TCPS 2484, plaintext 1521) using host firewalls and network segmentation; permit only required client subnets. This directly removes the AV:N precondition.
   • Rate-limit and enable connection throttling on the listener to blunt resource-exhaustion triggers.
   • Monitor for anomalous, high-rate TCPS connection churn and apply the detection rules above.
   • Because the vector requires UI:R, limit opportunities for coincident legitimate interaction: enforce least-privilege access and avoid unnecessary user-initiated connection patterns against exposed listeners.

2. Patch/upgrade steps.

   • Monitor the Oracle Critical Patch Update (CPU) and Security Alerts channels for an advisory addressing Oracle Net Services in versions 23.4.0–23.26.3.
   • Do not treat this as patched: no fix reference has been observed from any tracked source. Apply the vendor patch only once officially published, and stage it in a test environment first.

3. Long-term hardening.

   • Never expose Oracle Net Services listeners directly to the internet.
   • Enforce TLS-only Oracle Net configuration and disable legacy/unencrypted listener endpoints where feasible.
   • Maintain centralized logging of listener connection events and integrate the detection content above into the SOC.
   • Track the CVE in vulnerability management and re-evaluate EPSS/KEV status regularly given the open exposure window.

References

1. NVD — CVE-2026-83347: https://nvd.nist.gov/vuln/detail/CVE-2026-83347
2. Oracle Critical Patch Updates & Security Alerts: https://www.oracle.com/security-alerts/
3. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. FIRST EPSS: https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (check status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild evidence: none identified. No public PoC, exploit code, Nuclei template, or CISA KEV listing exists in the provided data; EPSS 0.00355 indicates low predicted exploitation activity at time of writing.