CVE-2026-71100: Medium severity Oracle Oracle Database Server vulnerability
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Oracle Database Server RDBMS deployments running affected supported versions are exposed if an attacker can reach Oracle Net over the network. The affected version ranges are 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3.
Does exploitation require an Oracle Database account or user interaction?
No. The vulnerability is described as easily exploitable by an unauthenticated attacker with network access via Oracle Net, with no user interaction required.
What is the likely impact of a successful attack?
A successful attack can give the attacker unauthorized read access to a subset of data accessible through the RDBMS. The stated impact is limited to confidentiality; integrity and availability impacts are not listed.