Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Portable Clusterware executes to compromise Portable Clusterware. While the vulnerability is in Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Portable Clusterware. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Oracle |
|
Configuration 1 [-]
|
No data.
References
| Link | Providers |
|---|---|
| https://www.oracle.com/security-alerts/cspuaug2026.html |
|
History
Thu, 20 Aug 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:* |
Thu, 20 Aug 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Physical Access Exploitation Compromises Clusterware in Oracle Database | |
| Weaknesses | CWE-200 |
Thu, 20 Aug 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Oracle database Server
|
|
| Vendors & Products |
Oracle database Server
|
Wed, 19 Aug 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Physical Access Exploitation Compromises Clusterware in Oracle Database | |
| Weaknesses | CWE-200 |
Wed, 19 Aug 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Unauthenticated Clusterware Takeover via Physical Network Access | |
| Weaknesses | CWE-284 CWE-285 |
Wed, 19 Aug 2026 05:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Unauthenticated Clusterware Takeover via Physical Network Access | |
| Weaknesses | CWE-284 CWE-285 |
Tue, 18 Aug 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Portable Clusterware executes to compromise Portable Clusterware. While the vulnerability is in Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Portable Clusterware. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). | |
| First Time appeared |
Oracle
Oracle database - Portable Clusterware |
|
| CPEs | cpe:2.3:a:oracle:database_-_portable_clusterware:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Oracle
Oracle database - Portable Clusterware |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: oracle
Published: 2026-08-18T21:03:19.665Z
Updated: 2026-08-18T21:03:19.665Z
Reserved: 2026-08-04T22:06:34.615Z
Link: CVE-2026-71064
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2026-08-18T21:18:06.313
Modified: 2026-08-20T15:09:29.440
Link: CVE-2026-71064
Redhat
No data.