CVE-2026-71100

Unauthenticated Oracle Database RDBMS Access Control Flaw Exposing Limited Data

View on CVE.org
Published Aug 18, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Analysis

AI-generated

Technical impact

The vulnerability exists in the RDBMS component of Oracle Database Server. An unauthenticated attacker with network access to the database via Oracle Net can exploit the flaw to read a subset of data stored in the RDBMS. The impact is primarily a confidentiality breach, allowing attackers to obtain sensitive information without needing credentials. This does not affect integrity or availability.

Affected Systems

Affected versions are Oracle Database Server 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. Systems running any of these releases without the applicable patch are vulnerable.

Risk and Exploitability

The CVSS 3.1 base score is 5.3, indicating a moderate severity level. The EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog. The attack vector operates over the network with Oracle Net, and the vulnerability requires no privileges or user interaction. Although the exploitability is low to moderate, the confidentiality impact makes the risk significant for environments handling sensitive data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch issued for CVE-2026-71100, which addresses the improper access control vulnerability (CWE-284)
  • Limit network access to Oracle Net connections by configuring firewalls or ACLs to allow only trusted hosts, mitigating authentication bypass routes (CWE-284)
  • Consider disabling or securing the Oracle Net listener on systems where the RDBMS is not required to be exposed, reducing the attack surface for the access-control flaw (CWE-284)

Generated by OpenCVE AI on August 21, 2026 at 02:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Unauthenticated Oracle Database RDBMS Access Control Flaw Exposing Limited Data
Type Values Removed Values Added
Title Unauthorized RDBMS Data Exposure via Oracle Net
Type Values Removed Values Added
CPEs cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title Unauthorized RDBMS Data Exposure via Oracle Net
Weaknesses CWE-200
Type Values Removed Values Added
Weaknesses CWE-200
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
Title Unauthorized Read Access Vulnerability in Oracle Database Server via Oracle Net
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
First Time appeared Oracle database Server
Vendors & Products Oracle database Server
Type Values Removed Values Added
Title Unauthorized Read Access Vulnerability in Oracle Database Server via Oracle Net
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Description Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle database - Rdbms
CPEs cpe:2.3:a:oracle:database_-_rdbms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle database - Rdbms
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Earlier changes (6)
Weaknesses

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Sep 17, 2026, 6:43 PM
Reserved
Aug 4, 2026, 10:06 PM

View source JSON

Updated
Aug 19, 2026, 3:07 PM

JSON

Status
Analyzed
Published
Aug 18, 2026, 9:18 PM
Modified
Oct 22, 2026, 5:09 PM

View source JSON

No data.

Updated
Aug 21, 2026, 2:15 AM

JSON