CVE-2026-71062: High severity Oracle Oracle Database Server vulnerability
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected supported Oracle Database Server versions are 23.4.0 through 23.26.3. The vulnerability is in the RDBMS component.
What level of access does an attacker need?
An attacker needs Authenticated User privilege and network access through Oracle Net. The issue does not require user interaction, but exploitation is rated high complexity.
Can an unauthenticated remote attacker exploit this issue?
No. The stated attack prerequisites include low-privileged authenticated access, so an unauthenticated attacker does not meet the listed requirements.
What could a successful compromise allow?
Successful exploitation can result in takeover of the RDBMS, with high confidentiality, integrity, and availability impact. Because the vulnerability has scope change, attacks may also significantly affect additional products.