Oracle Database Unsupported Version Detection

Tenable plugin 55786 is a *generic EOL/unsupported-version detector* for Oracle Database. It does not identify a specific CVE, exploit, or memory corruption bug. It fires whenever Nessus identifies an Oracle RDBMS instance whose major release has fallen off Oracle's Premier or Extended Support — historically 8i, 9i, 10g, 11g (all releases), 12.1, 18c, and 19c once it exits Extended Support (currently April 2027 for ES; 19c is the long-term release everyone should be migrating *to*, not away from). Affected installs receive zero Critical Patch Updates (CPUs), meaning every quarterly Oracle CPU since the support cutoff is unpatched on the host.

Tenable's blanket CRITICAL / CVSS 10.0 label is a *policy score*, not a vulnerability score. It is technically defensible (an unsupported DB engine eventually accumulates dozens of unpatched RCE / auth-bypass / privilege-escalation CVEs) but it overstates the *immediate* risk of any single instance. A 19c box that just hit EOL last quarter is not equivalent to an exposed 10g instance that's missed 14 years of CPUs. We downgrade to HIGH because the finding is real and persistent, but the score should reflect *role and exposure*, not a flat 10.0.

Why this verdict

• Policy score, not vuln score: Tenable's CVSS 10.0 is a flat label for any EOL software, regardless of whether a single CPU has been missed or fifteen years' worth. The actual exploit surface varies by 4+ orders of magnitude across the affected population.
• Friction — network position: Listeners on TCP/1521 are almost always behind segmentation; the attacker is *already inside* the data tier VLAN before this matters. That's a post-initial-access scenario.
• Friction — credential or exploit required: Pre-auth RCE against 11g+ is rare. The realistic chain requires either weak DBA creds or a known component CVE that the org happened to skip — not a single click-and-pwn.
• Role multiplier: Production database engine → chain ends in mass data egress, regulatory breach, and ransomware staging ground. Per the noisgate role catalog, prod DBs are floored at HIGH. If the box hosts PCI/PHI/PII, treat as CRITICAL.
• Role multiplier: Dev/test/sandbox DB → chain ends at one host with low-value data; without lateral pivot this is MEDIUM. But dev DBs frequently hold *production data copies* — verify before downgrading.

Why not higher?

Not CRITICAL because there is no specific weaponized exploit attached to this finding, no KEV listing, and no evidence of mass exploitation tied to the plugin itself. The attacker needs a working CVE for the exact sub-version AND network reach AND (usually) credentials — three compounding gates.

Why not lower?

Not MEDIUM because the affected component is a production database engine, which sits in the noisgate high-value-role catalog. Any successful chain ends in regulated-data exposure or a ransomware staging point. Treating EOL Oracle as MEDIUM 'config hygiene' is how breaches happen.

1. Inventory and classify every flagged instance — Within 30 days per noisgate HIGH SLA, build a spreadsheet: hostname, Oracle exact version (SELECT * FROM v$version), last CPU applied, network exposure (internal/DMZ/internet), data classification (prod/dev, PCI/PHI). You cannot prioritize what you have not enumerated.
2. Confirm Sustaining Support / Market Driven Support contract — Oracle Sustaining Support continues to ship CPUs to paying customers post-EOL. Many 'unsupported' Tenable findings are actually patched via MDS or ULA. Apply the latest available CPU for that branch within 30 days.
3. Network-isolate the listener — Restrict TCP/1521 (or custom port) at the firewall/microsegmentation layer to ONLY the application-tier IPs that legitimately connect. Combine with VALID_NODE_CHECKING_REGISTRATION=ON in listener.ora. Deploy within 30 days.
4. Disable Java VM and unused PL/SQL packages — UTL_FILE, UTL_HTTP, UTL_TCP, DBMS_LDAP, DBMS_SCHEDULER and the Java VM are common escalation primitives. Revoke EXECUTE from PUBLIC per Oracle's hardening guide. Apply within 30 days.
5. Force DBA account hygiene — Rotate SYS, SYSTEM, DBSNMP, SYSMAN, and any default accounts. Enforce SEC_CASE_SENSITIVE_LOGON=TRUE and account lockout. Audit with DBSAT (Oracle's free Database Security Assessment Tool).
6. Plan migration to 19c or 23ai — The 180-day noisgate remediation deadline for HIGH should drive the migration project plan. 19c is the current LTS; 23ai is the next. Treat this as a budget line, not a sprint task.

Run on the target Oracle host (or any host with sqlplus client + connectivity) as a user with SELECT_CATALOG_ROLE or higher. Invoke as: ./check_oracle_eol.sh user/pass@//dbhost:1521/SERVICE. Returns VULNERABLE if the running version is past Oracle Premier+Extended Support.

#!/usr/bin/env bash
# noisgate verification: Oracle Database unsupported version check (tenable:55786)
# Usage: ./check_oracle_eol.sh <user>/<pass>@//<host>:<port>/<service>
# Requires: sqlplus in PATH, SELECT on v$version

set -u
CONN="${1:-}"
if [[ -z "$CONN" ]]; then
  echo "UNKNOWN: usage: $0 user/pass@//host:port/service" >&2
  exit 2
fi

command -v sqlplus >/dev/null 2>&1 || { echo "UNKNOWN: sqlplus not found" >&2; exit 2; }

VER=$(sqlplus -s "$CONN" <<'SQL' 2>/dev/null | tr -d ' \r'
SET HEADING OFF FEEDBACK OFF PAGESIZE 0
SELECT version FROM v$instance;
EXIT;
SQL
)

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not query v\$instance — check creds/connectivity"
  exit 2
fi

echo "Detected Oracle version: $VER"

# EOL matrix as of 2026-06 (Premier + Extended Support both expired)
# 8.x, 9.x, 10.x, 11.x, 12.1.x, 18.x = EOL
# 12.2.x = EOL Mar 2022
# 19.x = Extended Support until Apr 2027 → SUPPORTED
# 21c = innovation release, EOL Apr 2025 → EOL
# 23ai = current LTS → SUPPORTED

MAJOR=$(echo "$VER" | cut -d. -f1)
MINOR=$(echo "$VER" | cut -d. -f2)

case "$MAJOR" in
  8|9|10|11|18|21)
    echo "VULNERABLE: Oracle $VER is past end of support — apply noisgate HIGH SLA"
    exit 1 ;;
  12)
    echo "VULNERABLE: Oracle 12.$MINOR is EOL (12.1 Jul 2022, 12.2 Mar 2022)"
    exit 1 ;;
  19)
    echo "PATCHED: Oracle 19c is in Extended Support until Apr 2027 — verify latest CPU applied"
    exit 0 ;;
  23)
    echo "PATCHED: Oracle 23ai is current LTS — verify latest CPU applied"
    exit 0 ;;
  *)
    echo "UNKNOWN: unrecognized major version $MAJOR"
    exit 2 ;;
esac

Sources

1. Tenable plugin 55786
2. Oracle Lifetime Support Policy (Database)
3. Oracle Critical Patch Update archive
4. odat — Oracle Database Attacking Tool
5. Oracle DBSAT — Database Security Assessment Tool
6. Metasploit Oracle modules
7. Oracle Database Security Guide — Listener hardening
8. CISA KEV catalog