CVE-2026-71062: Oracle Database Server Auth Bypass Vulnerability

CVE-2026-71062 Overview

CVE-2026-71062 is a high-severity vulnerability in the Relational Database Management System (RDBMS) component of Oracle Database Server. The flaw affects supported versions 23.4.0 through 23.26.3. An authenticated attacker with low privileges and network access via Oracle Net can compromise the RDBMS. Successful exploitation results in full takeover of the database server. The vulnerability carries a scope change, meaning attacks may significantly impact additional products beyond RDBMS itself. Oracle addressed the issue in the Oracle Critical Patch Update August 2026. The weakness is classified under [CWE-284] (Improper Access Control).

Critical Impact
Authenticated exploitation leads to complete takeover of the Oracle RDBMS with confidentiality, integrity, and availability impact, and scope change extending to additional products.

Affected Products

Oracle Database Server 23.4.0
Oracle Database Server versions 23.5.0 through 23.26.2
Oracle Database Server 23.26.3

Discovery Timeline

2026-08-18 - CVE-2026-71062 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database
August 2026 - Oracle releases fix in the Critical Patch Update advisory

Technical Details for CVE-2026-71062

Vulnerability Analysis

The vulnerability resides in the RDBMS component of Oracle Database Server, which handles core query execution, session management, and access control. An attacker with a valid authenticated user account can send crafted traffic over Oracle Net to trigger the flaw. Exploitation requires overcoming specific runtime conditions, which raises the attack complexity. Once triggered, the flaw allows the attacker to escape the security boundary of their session and compromise the database instance. The scope change indicator means the compromised component can affect resources managed by other components, expanding the blast radius beyond the database itself. Oracle documents impact across confidentiality, integrity, and availability, consistent with a full RDBMS takeover.

Root Cause

The issue is categorized as improper access control ([CWE-284]). The RDBMS component fails to correctly enforce authorization checks on a code path reachable by low-privileged authenticated users. This gap lets an attacker perform actions reserved for higher-privileged database roles. Oracle has not published detailed root-cause internals in the public advisory.

Attack Vector

The attack is delivered over the network through Oracle Net, the transport protocol used by Oracle Database clients. No user interaction is required. The attacker must already hold valid credentials for a low-privilege database account. Because of the scope change, a successful attack may pivot into other products that trust the RDBMS. The vulnerability requires attacker-controlled conditions to align, which limits opportunistic exploitation but does not prevent targeted abuse. Oracle has not disclosed exploit code, and no public proof-of-concept is available at the time of publication.

Detection Methods for CVE-2026-71062

Indicators of Compromise

Unexpected privilege escalation events in DBA_AUDIT_TRAIL or Unified Audit records for low-privileged accounts.
Anomalous Oracle Net client sessions originating from hosts that do not typically connect to the database listener.
Creation, alteration, or execution of SYS, SYSTEM, or PUBLIC-owned objects by non-administrative accounts.
Unexplained modifications to database configuration parameters or role grants outside change windows.

Detection Strategies

Enable Oracle Unified Auditing and monitor for privilege use that deviates from each account's baseline role.
Correlate listener logs (listener.log) with authentication events to identify session anomalies over Oracle Net.
Alert on execution of privileged PL/SQL packages such as DBMS_SYS_SQL, UTL_FILE, or DBMS_JAVA by low-privileged users.
Track version and patch level of every database instance to flag hosts still exposing versions in the 23.4.0–23.26.3 range.

Monitoring Recommendations

Forward Oracle audit, listener, and alert logs to a centralized SIEM for cross-source correlation.
Baseline normal query patterns per application service account and alert on deviations, especially DDL and role changes.
Monitor egress from database hosts for unexpected outbound connections that may indicate post-compromise pivoting.

How to Mitigate CVE-2026-71062

Immediate Actions Required

Apply the fixes documented in the Oracle Critical Patch Update August 2026 to all affected Oracle Database Server instances.
Inventory all Oracle Database 23c deployments and confirm the running version is outside the affected 23.4.0–23.26.3 range after patching.
Rotate credentials for low-privileged database accounts and review recent grants to detect unauthorized privilege changes.
Restrict network access to the Oracle Net listener so only authorized application hosts can reach the database.

Patch Information

Oracle addressed CVE-2026-71062 in the August 2026 Critical Patch Update. Administrators should review the Oracle Security Alert for the specific Release Update (RU) or Release Update Revision (RUR) that contains the fix for their database version. Apply the patch during the next scheduled maintenance window and validate that the post-patch banner reports a version above 23.26.3.

Workarounds

Enforce least privilege on database accounts and remove unused roles from application service users to reduce exploitation preconditions.
Configure Oracle Net Valid Node Checking (tcp.validnode_checking, tcp.invited_nodes) to limit which hosts can initiate database sessions.
Enable Oracle Database Vault or equivalent controls to add an additional authorization boundary around sensitive schemas until patching is complete.

bash

# Example: restrict Oracle Net access to trusted application hosts in sqlnet.ora
tcp.validnode_checking = yes
tcp.invited_nodes = (db-app-01, db-app-02, 10.20.30.0/24)
tcp.excluded_nodes = (0.0.0.0/0)