---
id: "CVE-2026-101510"
kind: "vulnerability"
aliases: ["CVE-2026-101510"]
title: "Oracle Database: Oracle Net Services flaw lets a local admin crash the listener"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "oracle-database", "oracle-net-services", "self-hosted"]
not_affected_if: ["no-shared-host-access", "unaffected-version"]
published_at: "2026-10-20T22:18:00+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:37:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101510", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Database: Oracle Net Services flaw lets a local admin crash the listener

Oracle Net Services, the networking layer of Oracle Database Server, can be made to hang or repeatedly crash by a highly privileged local user. The impact is denial of service only, with no confidentiality or integrity loss stated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle Database version with `SELECT * FROM v$version;` and compare against the affected ranges 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3
- Confirm whether the database is reachable from untrusted local accounts on the host

## Fix

- Move Oracle Database to a patched release listed in the Oracle Critical Patch Update for the July 2026 cycle or later (exact patched versions unknown from the sources)

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101510

## From the sources

Vulnerability in the Oracle Net Services component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows high privileged attacker having None privilege with logon to the infrastructure where Oracle Net Services executes to compromise Oracle Net Services.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_