GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

NCSC-2026-0373

Vulnerability from csaf_ncscnl - Published: 2026-09-16 13:51 - Updated: 2026-09-16 13:51
Summary
Kwetsbaarheden verholpen in Oracle Database Producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft 16 kwetsbaarheden verholpen in diverse Database producten, waaronder Database Server, Autonomous Health Framework en Application Testing Suite.
Interpretaties: De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores variërend van middel tot kritiek. Van de in totaal 16 kwetsbaarheden is één als kritiek aangemerkt en kunnen zes zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt. De kritieke kwetsbaarheid, CVE-2026-83149, heeft een CVSS-score van 9,1 en bevindt zich in Test Manager for Web Apps van Oracle Application Testing Suite. Volgens Oracle is een laaggeprivilegieerd account voor misbruik vereist en is geen gebruikersinteractie nodig. Succesvolle exploitatie kan een hoge impact hebben op de vertrouwelijkheid en een beperkte impact op de integriteit en beschikbaarheid van het getroffen systeem. Het NCSC adviseert om de beveiligingsupdate voor de kritieke kwetsbaarheid met voorrang toe te passen.
Oplossingen: Oracle heeeft updates uitgebracht om de genoemde kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-770: Allocation of Resources Without Limits or Throttling
CVE-2026-14456

OpenSSL QUIC server versions 3.5, 3.6, and 4.0 have a vulnerability allowing remote attackers to cause unbounded memory allocation and Denial of Service by sending numerous Initial packets, with Oracle Autonomous Health Framework also affected.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / Database Server
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Application Testing Suite
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Autonomous Health Framework
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Database Server
 vers:unknown/*
vers:unknown/*
Oracle Corporation / Oracle Application Testing Suite
 vers:unknown/*
CVE-2026-75838

DOMPurify versions before 3.4.13 have a cross-site scripting vulnerability in IN_PLACE sanitization due to element-removal hooks failing to neutralize detached subtrees, allowing execution of malicious event handlers post-sanitization, also affecting Oracle Autonomous Health Framework 26.8.

7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83088

A vulnerability in Oracle Database Server RDBMS versions 23.4.0 to 23.26.3 allows a low-privileged authenticated user with network access to cause denial of service by crashing or hanging the database, with a CVSS 3.1 score of 7.7.

7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83148

A critical remote code execution vulnerability in Oracle Application Testing Suite 13.3.0.1 allows low-privileged attackers with Test Manager for Web Apps access to fully compromise affected systems, rated CVSS 3.1 score 8.8.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83149

A critical vulnerability in Oracle Application Testing Suite 13.3.0.1 allows low-privileged attackers with Test Manager for Web Apps access and HTTP network connectivity to gain unauthorized data access, modify data, and cause partial denial of service, rated CVSS 9.1.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83150

A vulnerability in Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with infrastructure logon and user interaction to potentially take control of the application, with a CVSS 3.1 score of 7.0 indicating high impact.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83156

A high-severity vulnerability in Oracle XML Developers Kit for Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows low-privileged attackers with XDKC privilege and network access to potentially compromise the component.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83160

A critical vulnerability in Oracle Database Server RDBMS (versions 23.4.0-23.26.3) allows low-privileged attackers with Create Table privilege and network access to fully compromise the database, rated CVSS 8.8.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83271

A critical vulnerability in Oracle Database Server RDBMS versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows a low-privileged attacker with Execute on DBMS_REDEFINITION and network access to fully compromise the database, rated CVSS 8.8.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83272

A high-severity vulnerability in Oracle Text component of Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows low-privileged attackers with Create Index privilege and network access to potentially take control, rated CVSS 8.5.

8.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83333

A vulnerability in Oracle Net Services of Oracle Database Server versions 23.4.0 to 23.26.3 allows unauthenticated network attackers to cause denial of service by crashing or hanging the service, with a CVSS 3.1 base score of 7.5.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83347

A vulnerability in Oracle Net Services for Oracle Database Server versions 23.4.0 to 23.26.3 allows unauthenticated attackers with TCPS network access to cause a denial of service by hanging or crashing the service, with a CVSS score of 6.5.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83348

A critical vulnerability in Oracle Database Server RDBMS versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows low-privileged attackers with Create DB Link privilege and network access to fully compromise the system, rated CVSS 8.8.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83349

A vulnerability in Oracle Net Services affecting Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows unauthenticated network attackers to cause denial of service by hanging or crashing the service, with a CVSS 3.1 score of 7.5.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83350

A vulnerability in Oracle Net Services for Oracle Database Server versions 21.3-21.23 and 23.4.0-23.26.3 allows unauthenticated network attackers to cause denial of service by hanging or crashing the service, with a CVSS 3.1 base score of 7.5.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
CVE-2026-83351

A high-severity vulnerability in Oracle Database Server RDBMS versions 23.4.0 to 23.26.3 allows unauthenticated network attackers to potentially take control of the database via Oracle Net, with a CVSS 3.1 score of 8.1.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Known affected 5 products, the same list as for CVE-2026-14456
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft 16  kwetsbaarheden verholpen in diverse Database producten, waaronder Database Server, Autonomous Health Framework en Application Testing Suite.\n",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores vari\u00ebrend van middel tot kritiek. Van de in totaal 16 kwetsbaarheden is \u00e9\u00e9n als kritiek aangemerkt en kunnen zes zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nDe kritieke kwetsbaarheid, CVE-2026-83149, heeft een CVSS-score van 9,1 en bevindt zich in Test Manager for Web Apps van Oracle Application Testing Suite. Volgens Oracle is een laaggeprivilegieerd account voor misbruik vereist en is geen gebruikersinteractie nodig. Succesvolle exploitatie kan een hoge impact hebben op de vertrouwelijkheid en een beperkte impact op de integriteit en beschikbaarheid van het getroffen systeem.\n\nHet NCSC adviseert om de beveiligingsupdate voor de kritieke kwetsbaarheid met voorrang toe te passen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeeft updates uitgebracht om de genoemde kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.oracle.com/security-alerts/cspusep2026.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle Database Producten",
    "tracking": {
      "current_release_date": "2026-09-16T13:51:00.973000Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0373",
      "initial_release_date": "2026-09-16T13:51:00.973000Z",
      "revision_history": [
        {
          "date": "2026-09-16T13:51:00.973000Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Database Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Application Testing Suite"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Autonomous Health Framework"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-4"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Database Server"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-5"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Application Testing Suite"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14456",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "OpenSSL QUIC server versions 3.5, 3.6, and 4.0 have a vulnerability allowing remote attackers to cause unbounded memory allocation and Denial of Service by sending numerous Initial packets, with Oracle Autonomous Health Framework also affected.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-14456 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14456.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-14456"
    },
    {
      "cve": "CVE-2026-75838",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "DOMPurify versions before 3.4.13 have a cross-site scripting vulnerability in IN_PLACE sanitization due to element-removal hooks failing to neutralize detached subtrees, allowing execution of malicious event handlers post-sanitization, also affecting Oracle Autonomous Health Framework 26.8.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-75838 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-75838.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-75838"
    },
    {
      "cve": "CVE-2026-83088",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle Database Server RDBMS versions 23.4.0 to 23.26.3 allows a low-privileged authenticated user with network access to cause denial of service by crashing or hanging the database, with a CVSS 3.1 score of 7.7.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83088 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83088.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83088"
    },
    {
      "cve": "CVE-2026-83148",
      "notes": [
        {
          "category": "description",
          "text": "A critical remote code execution vulnerability in Oracle Application Testing Suite 13.3.0.1 allows low-privileged attackers with Test Manager for Web Apps access to fully compromise affected systems, rated CVSS 3.1 score 8.8.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83148 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83148.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83148"
    },
    {
      "cve": "CVE-2026-83149",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle Application Testing Suite 13.3.0.1 allows low-privileged attackers with Test Manager for Web Apps access and HTTP network connectivity to gain unauthorized data access, modify data, and cause partial denial of service, rated CVSS 9.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83149 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83149.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83149"
    },
    {
      "cve": "CVE-2026-83150",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with infrastructure logon and user interaction to potentially take control of the application, with a CVSS 3.1 score of 7.0 indicating high impact.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83150 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83150.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83150"
    },
    {
      "cve": "CVE-2026-83156",
      "notes": [
        {
          "category": "description",
          "text": "A high-severity vulnerability in Oracle XML Developers Kit for Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows low-privileged attackers with XDKC privilege and network access to potentially compromise the component.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83156 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83156.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83156"
    },
    {
      "cve": "CVE-2026-83160",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle Database Server RDBMS (versions 23.4.0-23.26.3) allows low-privileged attackers with Create Table privilege and network access to fully compromise the database, rated CVSS 8.8.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83160 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83160.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83160"
    },
    {
      "cve": "CVE-2026-83271",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle Database Server RDBMS versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows a low-privileged attacker with Execute on DBMS_REDEFINITION and network access to fully compromise the database, rated CVSS 8.8.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83271 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83271.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83271"
    },
    {
      "cve": "CVE-2026-83272",
      "notes": [
        {
          "category": "description",
          "text": "A high-severity vulnerability in Oracle Text component of Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows low-privileged attackers with Create Index privilege and network access to potentially take control, rated CVSS 8.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83272 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83272.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83272"
    },
    {
      "cve": "CVE-2026-83333",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle Net Services of Oracle Database Server versions 23.4.0 to 23.26.3 allows unauthenticated network attackers to cause denial of service by crashing or hanging the service, with a CVSS 3.1 base score of 7.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83333 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83333.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83333"
    },
    {
      "cve": "CVE-2026-83347",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle Net Services for Oracle Database Server versions 23.4.0 to 23.26.3 allows unauthenticated attackers with TCPS network access to cause a denial of service by hanging or crashing the service, with a CVSS score of 6.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83347 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83347.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83347"
    },
    {
      "cve": "CVE-2026-83348",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle Database Server RDBMS versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows low-privileged attackers with Create DB Link privilege and network access to fully compromise the system, rated CVSS 8.8.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83348 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83348.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83348"
    },
    {
      "cve": "CVE-2026-83349",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle Net Services affecting Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 allows unauthenticated network attackers to cause denial of service by hanging or crashing the service, with a CVSS 3.1 score of 7.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83349 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83349.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83349"
    },
    {
      "cve": "CVE-2026-83350",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle Net Services for Oracle Database Server versions 21.3-21.23 and 23.4.0-23.26.3 allows unauthenticated network attackers to cause denial of service by hanging or crashing the service, with a CVSS 3.1 base score of 7.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83350 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83350.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83350"
    },
    {
      "cve": "CVE-2026-83351",
      "notes": [
        {
          "category": "description",
          "text": "A high-severity vulnerability in Oracle Database Server RDBMS versions 23.4.0 to 23.26.3 allows unauthenticated network attackers to potentially take control of the database via Oracle Net, with a CVSS 3.1 score of 8.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83351 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83351.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-83351"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.