Critical severity · published May 28, 2026
CVE-2026-46833
Vulnerability in the Net Service component of Oracle Database Server
9.0
CVSS
0.3%
EPSS
No
On KEV
Description
Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. While the vulnerability is in Net Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Net Service. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
Oracle Database Server · Oracle Corporation
23.4.0 through 23.26.2 · source: vendor
DS
Database Server · Oracle
23.4.0 through 23.26.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46833
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46833
Vendor Advisory
https://www.oracle.com/security-alerts/cspumay2026.html
More from Oracle Database Server
9.9
CVE-2026-61211
Vulnerability in the RDBMS component of Oracle Database Server
9.6
CVE-2026-71064
Vulnerability in the Portable Clusterware component of Oracle Database Server
9.6
CVE-2026-71063
Vulnerability in the Portable Clusterware component of Oracle Database Server
9.1
CVE-2026-71102
Vulnerability in the Portable Clusterware component of Oracle Database Server
8.8
CVE-2026-91499
Vulnerability in the RDBMS component of Oracle Database Server