CVE-2026-71063 Overview
CVE-2026-71063 is a critical vulnerability in the Portable Clusterware component of Oracle Database Server. The flaw allows an unauthenticated attacker with access to the adjacent network segment to compromise Portable Clusterware. Because the vulnerability introduces a scope change, successful exploitation can also impact additional Oracle products beyond the vulnerable component.
Affected versions include Oracle Database Server 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. Oracle published the fix in the Oracle Security Alert August 2026. The weakness is classified under [CWE-284] (Improper Access Control).
Critical Impact
Adjacent-network attackers without credentials can take over Oracle Portable Clusterware and pivot to impact other clustered products.
Affected Products
- Oracle Database Server, Portable Clusterware component, versions 19.3 – 19.32
- Oracle Database Server, Portable Clusterware component, versions 21.3 – 21.23
- Oracle Database Server, Portable Clusterware component, versions 23.4.0 – 23.26.3
Discovery Timeline
- 2026-08-18 - CVE-2026-71063 published to NVD as part of the Oracle Security Alert August 2026
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-71063
Vulnerability Analysis
Oracle Portable Clusterware provides clustering services that coordinate Oracle Database instances across nodes over an interconnect network. CVE-2026-71063 permits an unauthenticated attacker on the adjacent network segment to interact with Portable Clusterware in a way that leads to full compromise of the component.
Oracle notes that a successful attack changes scope, meaning it can affect resources managed outside the vulnerable component itself. Because Portable Clusterware coordinates nodes, database services, and shared resources, a takeover propagates control to workloads that trust the clusterware layer.
The advisory describes exploitation as easy and requiring no user interaction. Confidentiality, integrity, and availability are each impacted at the high level.
Root Cause
The issue is categorized as improper access control [CWE-284]. Portable Clusterware does not adequately restrict which peers on the physical communication segment can invoke privileged clusterware operations. An attacker on the interconnect can therefore issue requests that the component treats as trusted.
Attack Vector
The attack vector is adjacent network. The attacker must reach the physical communication segment attached to the hardware where Portable Clusterware executes, typically the private cluster interconnect. From that position, the attacker sends crafted messages to the clusterware service and gains control without authenticating.
No verified public exploit is available at this time. See the Oracle Security Alert August 2026 for vendor technical details.
Detection Methods for CVE-2026-71063
Indicators of Compromise
- Unexpected clusterware processes, resource restarts, or node evictions coordinated by Oracle Grid Infrastructure services such as crsd, ohasd, and cssd.
- New or unauthorized nodes joining the cluster, or unexplained changes to Oracle Cluster Registry (OCR) and voting disk contents.
- Anomalous traffic on the private cluster interconnect from hosts that are not registered cluster members.
Detection Strategies
- Baseline expected MAC and IP addresses on the cluster interconnect VLAN and alert on any unknown source communicating with clusterware ports.
- Monitor Grid Infrastructure alert logs (alert<nodename>.log, ocssd.log, crsd.log) for unexpected reconfiguration, membership changes, or authentication failures.
- Correlate operating-system audit logs with clusterware events to identify privileged command execution originating from cluster-managed processes.
Monitoring Recommendations
- Forward Oracle Grid Infrastructure and OS audit logs to a centralized analytics platform for correlation across all cluster nodes.
- Enable network flow logging on the interconnect segment and alert on traffic sourced outside the approved node list.
- Track Oracle patch inventory using opatch lspatches to confirm the August 2026 CPU is applied on every node.
How to Mitigate CVE-2026-71063
Immediate Actions Required
- Apply the Oracle Critical Patch Update from the August 2026 Security Alert to all Portable Clusterware deployments running 19.3–19.32, 21.3–21.23, or 23.4.0–23.26.3.
- Inventory all Oracle Database Server nodes and identify any still exposed to shared or routed interconnect networks.
- Restrict physical and logical access to the cluster interconnect to authorized nodes only, using dedicated switches or isolated VLANs.
Patch Information
Oracle addressed CVE-2026-71063 in the Oracle Security Alert August 2026. Administrators should follow the standard Grid Infrastructure patching procedure with opatchauto and validate cluster health after each node is updated. No configuration change alone remediates the underlying access-control flaw.
Workarounds
- Isolate the cluster interconnect on a dedicated physical or virtualized network with no path from user or management VLANs.
- Enforce switch-level port security, MAC filtering, and private VLANs so only cluster member NICs can communicate on the interconnect.
- Where supported, enable IPsec or equivalent authenticated transport between cluster nodes to block unauthenticated peers.
- Monitor and alert on any Layer 2 additions to the interconnect segment until patching is complete on every node.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
