Description
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the RDBMS component of Oracle Database Server. An unauthenticated attacker with network access to the database via Oracle Net can exploit the flaw to read a subset of data stored in the RDBMS. The impact is primarily a confidentiality breach, allowing attackers to obtain sensitive information without needing credentials. This does not affect integrity or availability.

Affected Systems

Affected versions are Oracle Database Server 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. Systems running any of these releases without the applicable patch are vulnerable.

Risk and Exploitability

The CVSS 3.1 base score is 5.3, indicating a moderate severity level. The EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog. The attack vector operates over the network with Oracle Net, and the vulnerability requires no privileges or user interaction. Although the exploitability is low to moderate, the confidentiality impact makes the risk significant for environments handling sensitive data.

Generated by OpenCVE AI on August 21, 2026 at 02:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch issued for CVE-2026-71100, which addresses the improper access control vulnerability (CWE-284)
  • Limit network access to Oracle Net connections by configuring firewalls or ACLs to allow only trusted hosts, mitigating authentication bypass routes (CWE-284)
  • Consider disabling or securing the Oracle Net listener on systems where the RDBMS is not required to be exposed, reducing the attack surface for the access-control flaw (CWE-284)

Generated by OpenCVE AI on August 21, 2026 at 02:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Oracle Database RDBMS Access Control Flaw Exposing Limited Data

Thu, 20 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Title Unauthorized RDBMS Data Exposure via Oracle Net

Thu, 20 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unauthorized RDBMS Data Exposure via Oracle Net
Weaknesses CWE-200

Wed, 19 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Wed, 19 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 19 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access Vulnerability in Oracle Database Server via Oracle Net
Weaknesses CWE-200
CWE-284

Wed, 19 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle database Server
Vendors & Products Oracle database Server

Wed, 19 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access Vulnerability in Oracle Database Server via Oracle Net
Weaknesses CWE-200
CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle database - Rdbms
CPEs cpe:2.3:a:oracle:database_-_rdbms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle database - Rdbms
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Database - Rdbms Database Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:01:30.051Z

Reserved: 2026-08-04T22:06:34.617Z

Link: CVE-2026-71100

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:10.263

Modified: 2026-08-20T15:09:13.907

Link: CVE-2026-71100

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T02:15:04Z

Weaknesses