CVE-2026-71102: 
Oracle Database Server vulnerability analysis and mitigation

CVE-2026-71102 is an improper access control vulnerability in the Portable Clusterware component of Oracle Database Server. It affects versions 19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3. The vulnerability was disclosed on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU) for August 2026. It carries a CVSS v3.1 base score of 9.1 (Critical), reflecting high integrity and availability impacts with no authentication required (Oracle Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control), meaning the Portable Clusterware component fails to properly enforce access restrictions on HTTP-accessible interfaces. An unauthenticated attacker with network access can send crafted HTTP requests to the affected component without any credentials or user interaction, exploiting the lack of proper authorization checks. The attack complexity is low and no privileges are required, making this easily exploitable over any network with HTTP access to the target (Oracle Advisory, Feedly).

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical data accessible to the Portable Clusterware component, resulting in a high integrity impact. Additionally, the attacker can cause the Portable Clusterware service to hang or crash repeatedly, resulting in a complete denial of service (high availability impact). Confidentiality is not directly impacted by this vulnerability. Given that Portable Clusterware manages cluster infrastructure for Oracle Database, disruption could affect database availability across clustered environments (Oracle Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is rated as automatable (yes) by NVD SSVC analysis, meaning exploitation can be scripted without manual interaction. The EPSS score is approximately 0.0044 (0.44%), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. Detection coverage is available via Qualys (detection ID 20609) and Tenable (Nessus plugin 338071) (Oracle Advisory).

1. Reconnaissance: Identify Oracle Database Server deployments running versions 19.3–19.32, 21.3–21.23, or 23.4.0–23.26.3 with Portable Clusterware HTTP interfaces exposed to the network, using tools such as Shodan, Censys, or internal network scanning.
2. Identify HTTP endpoint: Locate the HTTP service port used by the Portable Clusterware component on the target Oracle Database Server host.
3. Craft malicious HTTP request: Construct an unauthenticated HTTP request targeting the Portable Clusterware HTTP interface that exploits the improper access control flaw — bypassing authorization checks to perform data manipulation or trigger a denial-of-service condition.
4. Execute attack: Send the crafted request to the target. Depending on the payload, this can result in unauthorized creation, deletion, or modification of Portable Clusterware data, or cause the service to hang or crash repeatedly.
5. Achieve objective: Confirm denial of service by observing cluster service unavailability, or verify data integrity compromise by checking for unauthorized changes to Portable Clusterware configuration or data (Oracle Advisory).

• Network: Unexpected or anomalous unauthenticated HTTP requests to the Portable Clusterware HTTP service port from external or untrusted IP addresses; repeated connection attempts to the Clusterware HTTP interface.
• Logs: Oracle Clusterware alert logs ($GRID_HOME/log/<hostname>/alertlog) showing repeated service crashes, hangs, or unexpected restarts; HTTP access logs showing unauthenticated requests to Clusterware management endpoints.
• Availability: Frequent or repeatable crashes of Portable Clusterware services (e.g., crsd, ocssd, ohasd) without a clear operational cause; cluster nodes reporting unexpected evictions or resource failures.
• File System: Unauthorized modifications, deletions, or newly created files in Portable Clusterware data directories (e.g., Oracle Cluster Registry or Voting Disk contents showing unexpected changes).

Oracle has released patches for all affected versions (19.3–19.32, 21.3–21.23, 23.4.0–23.26.3) as part of the August 2026 Critical Security Patch Update; customers should apply these patches immediately (Oracle Advisory). As a temporary workaround, restrict network access to the Portable Clusterware HTTP interface using firewall rules or network segmentation, allowing only trusted hosts to reach the service. Oracle strongly recommends against relying on network-level mitigations as a long-term solution, as they do not address the underlying vulnerability.

The vulnerability was noted in the AUSCERT bulletin ASB-2026.0205 and tracked by VulDB (entry 392257) shortly after Oracle's disclosure. Detection plugins were published by Tenable (Nessus plugin 338071) and Qualys (detection ID 20609) within days of the advisory. No significant independent researcher commentary or major media coverage specific to CVE-2026-71102 has been identified beyond standard vulnerability tracking and scanner updates (Oracle Advisory).