{"id":"CVE-2026-101510","kind":"vulnerability","aliases":["CVE-2026-101510"],"related":[],"title":"Oracle Database: Oracle Net Services flaw lets a local admin crash the listener","description":"Vulnerability in the Oracle Net Services component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows high privileged attacker having None privilege with logon to the infrastructure where Oracle Net Services executes to compromise Oracle Net Services.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","summary":"Oracle Net Services, the networking layer of Oracle Database Server, can be made to hang or repeatedly crash by a highly privileged local user. The impact is denial of service only, with no confidentiality or integrity loss stated.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","oracle-database","oracle-net-services","self-hosted"],"not_affected_if":["no-shared-host-access","unaffected-version"],"how_to_check":"- Check the installed Oracle Database version with `SELECT * FROM v$version;` and compare against the affected ranges 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3\n- Confirm whether the database is reachable from untrusted local accounts on the host","fix":"- Move Oracle Database to a patched release listed in the Oracle Critical Patch Update for the July 2026 cycle or later (exact patched versions unknown from the sources)","status":"open","published_at":"2026-10-20T22:18:00+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:37:09+00:00","updated_at":"2026-10-25T04:37:09+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:37:09Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle Database to a patched release listed in the Oracle Critical Patch Update for the July 2026 cycle or later (exact patched versions unknown from the sources)","reach":"local","title":"Oracle Database: Oracle Net Services flaw lets a local admin crash the listener","impact":"low","summary":"Oracle Net Services, the networking layer of Oracle Database Server, can be made to hang or repeatedly crash by a highly privileged local user. The impact is denial of service only, with no confidentiality or integrity loss stated.","category":"infrastructure","nicknames":[],"who_cares":["oracle-database","oracle-net-services","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Denial of service: Oracle Net Services hangs or repeatedly crashes.","analyst_note":"Sources do not name the patched release numbers; check the Oracle Critical Patch Update advisory for the matching fixed versions.","how_to_check":"- Check the installed Oracle Database version with `SELECT * FROM v$version;` and compare against the affected ranges 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3\n- Confirm whether the database is reachable from untrusted local accounts on the host","needs_analyst":true,"not_affected_if":["unaffected-version","no-shared-host-access"],"who_is_affected":"Systems running Oracle Database Server in the affected version ranges where users with logon access to the host where Oracle Net Services runs could abuse it. Attacker must already hold high privileges on the infrastructure, so exposure is limited to shared or multi-tenant hosts. Databases on fully patched or non-affected versions can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":3474,"output_tokens":628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101510':16A,19A '-19.32':87C '-2026':15A,18A '-21.23':89C '/av':153C '19.3':86C '21.3':88C '23.26.3':92C '23.4.0':91C '3.1':143C,152C '4.4':146C 'abil':127C 'admin':10A 'affect':84C 'allow':96C 'attack':99C,119C 'avail':147C 'base':144C 'caus':129C 'complet':136C 'compon':75C 'compromis':114C 'confidenti':64B 'crash':11A,48B,135C 'cve':14A,17A 'cvss':142C,149C,151C 'databas':2A,23B,39B,78C 'denial':58B 'dos':137C 'easili':93C 'execut':112C 'exploit':94C 'flaw':6A 'frequent':133C 'h':161C 'h/ui':156C 'hang':45B,131C 'high':51B,97C 'host':30B 'impact':56B,148C 'infrastructur':20B,107C 'integr':66B 'l/ac':154C 'l/pr':155C 'layer':36B 'let':7A 'listen':13A 'local':9A,53B 'logon':104C 'loss':67B 'made':43B 'n/a':160C 'n/i':159C 'n/s':157C 'net':4A,26B,32B,73C,110C,116C,140C 'network':35B 'none':101C 'oracl':1A,3A,22B,25B,31B,38B,72C,77C,109C,115C,139C 'oracle-databas':21B 'oracle-net-servic':24B 'privileg':52B,98C,102C 'repeat':47B,134C 'result':124C 'score':145C 'self':29B 'self-host':28B 'server':40B,79C 'servic':5A,27B,33B,60B,74C,111C,117C,141C 'state':68B 'success':118C 'support':80C 'u/c':158C 'unauthor':126C 'user':54B 'vector':150C 'version':81C 'vulner':69C,95C,122C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Database Server in the affected version ranges where users with logon access to the host where Oracle Net Services runs could abuse it. Attacker must already hold high privileges on the infrastructure, so exposure is limited to shared or multi-tenant hosts. Databases on fully patched or non-affected versions can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101510","severity":null,"published_at":"2026-10-20T22:18:00+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}