Answer
Log on to the database server itself (not remotely through a client tool) and run the kill command locally through SQL*Plus, connected AS SYSDBA: sqlplus / as sysdba then ALTER SYSTEM KILL SESSION '<sid>,<serial#>';. Running the identical command locally on the server as SYSDBA has succeeded in cases where the same command failed with ORA-00026 when run remotely through a client tool like SQL Developer — the session then clears from v$session once Oracle's PMON background process catches up.