CVE-2026-71100 in Database Server
Summary
by MITRE • 08/19/2026
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Relational Database Management System component of Oracle Database Server, affecting supported versions including releases from 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. This flaw is characterized by an easily exploitable condition that permits unauthenticated attackers to gain unauthorized access via the Oracle Net protocol. The attack vector is network-based, meaning that any entity with connectivity to the database server's listening ports can attempt to exploit this weakness without requiring prior authentication or user interaction.
From a technical perspective, the core issue involves improper handling of requests within the RDBMS layer when processed over the network interface. While specific implementation details are not disclosed in the summary, such vulnerabilities typically stem from insufficient validation of input data sent through Oracle Net services. This allows an attacker to manipulate internal state or query mechanisms to bypass standard access controls. The absence of required authentication highlights a critical failure in the initial request processing logic, where the system fails to properly enforce identity verification before granting limited read privileges to sensitive structures.
The operational impact of this vulnerability is primarily focused on data confidentiality rather than integrity or availability. Successful exploitation results in unauthorized read access to a subset of RDBMS accessible data. This means that while an attacker cannot modify existing records or disrupt database operations, they can extract specific pieces of information stored within the database. The scope remains unchanged according to the CVSS metrics, indicating that the vulnerability affects only the vulnerable component and does not allow for privilege escalation beyond the initial read access granted by this flaw.
In terms of industry standard classifications, this vulnerability aligns with CWE-287, which describes Improper Authentication, as it allows an unauthenticated actor to perform actions within the system. Furthermore, given that the attack is conducted over a network connection without user interaction, it maps closely to MITRE ATT&CK techniques related to Initial Access and Discovery, specifically those involving database protocol exploitation. The CVSS 3.1 base score of 5.3 reflects its medium severity, driven by high availability requirements for databases but limited impact due to the read-only nature of the compromise.
Mitigation strategies should prioritize immediate patching if possible, as Oracle typically releases security patches that address such flaws in subsequent updates or interim fixes. For environments where patching is not immediately feasible, network segmentation and firewall rules are critical defensive measures. Administrators should restrict access to Oracle Net ports, typically port 1521 for standard listeners, allowing connections only from trusted IP addresses or application servers. Additionally, enabling advanced auditing features can help detect unusual query patterns that may indicate exploitation attempts. It is also advisable to review database listener configurations to ensure that unnecessary services are disabled and that strong authentication methods are enforced where applicable to reduce the attack surface exposed to unauthenticated actors.