CVE-2026-71100: 
Oracle Database Server vulnerability analysis and mitigation

CVE-2026-71100 is an improper access control vulnerability in the RDBMS component of Oracle Database Server that allows unauthenticated remote attackers to read a subset of database-accessible data. Disclosed on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU), it affects Oracle Database Server versions 19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle Advisory, NVD).

The vulnerability is classified as CWE-284 (Improper Access Control), meaning the RDBMS component fails to properly enforce access restrictions on certain data accessible via the Oracle Net protocol (NVD). An unauthenticated attacker with network access to the Oracle Net listener can exploit this flaw without requiring any user credentials or interaction, and with low attack complexity. No specific technical write-ups or public proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation results in unauthorized read access to a subset of data accessible within the RDBMS, with no impact on data integrity or system availability. The confidentiality impact is rated Low, meaning only a limited portion of database data may be exposed rather than full database contents. There is no evidence of lateral movement capability or privilege escalation associated with this vulnerability (Oracle Advisory, NVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been observed for CVE-2026-71100 (Feedly). CISA's SSVC assessment classifies the vulnerability as automatable (yes) with partial technical impact and no known exploitation (NVD). The EPSS score is approximately 0.316%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Oracle has released patches for all affected versions (19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3) as part of the August 2026 Critical Security Patch Update, and customers should apply these patches immediately (Oracle Advisory). As a temporary workaround, Oracle recommends restricting network access to Oracle Net ports to authorized clients only and implementing network segmentation to limit database server exposure to untrusted networks. Oracle strongly cautions that network-based workarounds are not long-term solutions and may impact application functionality.