CVE-2026-71063: Critical severity Oracle Oracle Database Server (Portable Clusterware) vulnerability
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Portable Clusterware executes to compromise Portable Clusterware. While the vulnerability is in Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Portable Clusterware. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this vulnerability?
Oracle Database Server deployments using Portable Clusterware in versions 19.3 through 19.32, 21.3 through 21.23, or 23.4.0 through 23.26.3 are affected. Exploitation requires access to the physical communication segment connected to the hardware running Portable Clusterware.
Does an attacker need credentials or user interaction to exploit it?
No. The vulnerability is described as easily exploitable by an unauthenticated attacker and does not require user interaction, provided the attacker can access the relevant physical communication segment.
What is the potential impact beyond the Portable Clusterware component?
Successful exploitation can result in takeover of Portable Clusterware, with high confidentiality, integrity, and availability impact. The scope may extend to additional products because the vulnerability has a scope change.