CVE-2026-71102 in Database Server
Summary
by MITRE • 08/19/2026
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Portable Clusterware. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Portable Clusterware accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Portable Clusterware. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Portable Clusterware component of Oracle Database Server, a critical subsystem responsible for managing high availability and clustering services across distributed database environments. This flaw affects multiple supported releases, specifically versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. The severity of this issue is underscored by a CVSS v3.1 base score of 9.1, indicating a Critical level risk that demands immediate attention from infrastructure administrators and security operations teams responsible for maintaining the integrity and availability of Oracle-based enterprise systems.
From a technical perspective, the vulnerability allows an unauthenticated attacker to exploit the flaw via network access through HTTP without requiring any user interaction or prior authentication credentials. This characteristic significantly lowers the barrier to entry for malicious actors, as it eliminates the need for social engineering or credential theft phases typically associated with high-severity exploits. The attack vector is classified as Network-based with Low Attack Complexity and no required User Interaction, which aligns with common patterns observed in remote code execution or denial-of-service vulnerabilities found in widely deployed enterprise software components.
The operational impact of a successful exploitation is severe, encompassing both integrity and availability dimensions. An attacker can achieve unauthorized creation, deletion, or modification of critical data stored within the Portable Clusterware environment. This capability directly compromises the confidentiality and consistency of cluster state information, which may lead to split-brain scenarios, incorrect failover decisions, or corruption of shared resources managed by the clustering software. Furthermore, the vulnerability enables an attacker to cause a hang or a frequently repeatable crash of the Portable Clusterware process, resulting in a complete denial of service for the associated database instances and dependent applications that rely on continuous availability provided by the cluster infrastructure.
In terms of industry standard classifications, this vulnerability maps closely to CWE-20 Improper Input Validation, as the flaw likely stems from insufficient sanitization or validation of HTTP requests processed by the component. Additionally, the ability to cause a crash aligns with CWE-400 Uncontrolled Resource Consumption when viewed through the lens of denial-of-service impacts. From an offensive security framework perspective, such exploitation techniques are often associated with MITRE ATT&CK tactics related to Initial Access and Impact, specifically leveraging network services for unauthorized access or resource exhaustion to disrupt business operations.
Mitigation strategies must prioritize immediate patching to the latest available version within the supported release lines mentioned above. Organizations should also implement strict network segmentation policies to restrict HTTP access to cluster management interfaces from untrusted networks. Deploying web application firewalls with rules designed to detect anomalous request patterns targeting Oracle-specific endpoints can provide an additional layer of defense in depth while patching is being applied. Continuous monitoring for signs of service instability or unexpected process restarts within the cluster environment should also be enforced to facilitate rapid detection and response if exploitation attempts occur despite preventive measures.