Component takeover in Oracle Data Provider for .NET

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

• CVE-2023-21893: 0.61% estimated exploitation activity in the next 30 days; percentile 49.30 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). See the readme.txt files inside the .nupkg packages for a reference to the fix.

Published by the source

18 Jan 2023, 00:30 UTC

Last modified by the source

17 Sep 2024, 16:27 UTC

Source last checked

26 Oct 2026, 17:00 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-5pm2-9mr2-3frq

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2023-21893

Advisory: Component takeover in Oracle Data Provider for .NET
IDs: CVE-2023-21893, GHSA-5pm2-9mr2-3frq
Record: https://patchnext.com/advisories/cve-2023-21893 (revision 1, source checked 26 Oct 2026, 17:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: oracle.manageddataaccess 21.9.0, 19.18.0; oracle.manageddataaccess.core 3.21.90, 2.19.180. A vendor fix does not mean a deployment is fixed.

## Affected components
- NuGet oracle.manageddataaccess: affected >= 21.0.0, < 21.9.0; >= 19.0.0, < 19.18.0; fixed in 21.9.0, 19.18.0
- NuGet oracle.manageddataaccess.core: affected >= 3.21.0, < 3.21.90; >= 2.19.0, < 2.19.180; fixed in 2.19.180, 3.21.90

## Suggested inspection (read-only)
- NuGet oracle.manageddataaccess: check the installed version with your package manager.
- NuGet oracle.manageddataaccess.core: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on oracle.manageddataaccess, oracle.manageddataaccess.core.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-5pm2-9mr2-3frq (GitHub-reviewed advisory GHSA-5pm2-9mr2-3frq lists affected ranges: NuGet oracle.manageddataaccess >=21.0.0 =19.0.0 =3.21.0 =2.19.0 <2.19.180)

Commands are suggestions: review each one before running it.