CVE-2026-71100: 
Oracle Database Server vulnerability analysis and mitigation

CVE-2026-71100 is an improper access control vulnerability in the RDBMS component of Oracle Database Server that allows unauthenticated attackers with network access via Oracle Net to read a subset of RDBMS-accessible data. It was disclosed and patched on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU). Affected versions include Oracle Database Server 19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3. It carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) within the RDBMS component of Oracle Database Server. An unauthenticated attacker with network access via the Oracle Net protocol can exploit this flaw without requiring any privileges or user interaction, making it easily exploitable in network-accessible deployments. The attack vector is network-based with low complexity, and the scope remains unchanged, with only confidentiality impact (partial data read access). No detailed technical write-up or public proof-of-concept code has been identified at this time (Oracle Advisory).

Successful exploitation results in unauthorized read access to a subset of data accessible to the RDBMS component, constituting a confidentiality breach. There is no impact on integrity or availability. The exposure is limited to data accessible through the Oracle Net interface, and there is no evidence of lateral movement capability or privilege escalation associated with this vulnerability (Oracle Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The vulnerability is automatable (no user interaction required) and exploitable without authentication, which lowers the barrier for opportunistic attackers. The EPSS score is approximately 0.00316, indicating a low probability of exploitation in the near term. CVE-2026-71100 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Oracle Advisory).

Oracle has released patches for all affected versions (19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3) as part of the August 2026 Critical Security Patch Update; organizations should apply these patches immediately. As a temporary workaround, restrict network access to Oracle Database Server's Oracle Net listener to trusted hosts only using firewall rules or network segmentation. Oracle strongly advises against relying on workarounds as a long-term solution, as they do not address the underlying vulnerability (Oracle Advisory).