---
id: "CVE-2026-91479"
kind: "vulnerability"
aliases: ["CVE-2026-91479"]
title: "Oracle Database Server: unauthenticated attacker can crash RDBMS via adjacent network"
severity: "medium"
cvss: 6.5
epss: 0.00234
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database-admins", "oracle-database", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "version-outside-range"]
published_at: "2026-10-20T22:20:51+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91479", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91479", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Database Server: unauthenticated attacker can crash RDBMS via adjacent network

A flaw in the RDBMS component of Oracle Database Server lets an unauthenticated attacker hang or repeatedly crash the database. The attacker needs access to the physical network segment attached to the hardware running the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `SELECT * FROM v$version;` and compare it to the affected range 23.4.0 through 23.26.3
- Confirm whether the database server sits on a shared segment reachable from outside the data centre network (unknown if the sources say more)

## Fix

- Move Oracle Database Server to a version outside the affected range 23.4.0 to 23.26.3, using the patch named in Oracle's Critical Patch Update advisory (unknown exact patch in the sources)

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91479
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91479

## From the sources

Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the RDBMS executes to compromise RDBMS.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_