CVE-2026-71064: Oracle Database Server Privilege Escalation

CVE-2026-71064 Overview

CVE-2026-71064 is a critical vulnerability in the Portable Clusterware component of Oracle Database Server. The flaw allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running Portable Clusterware to fully compromise the component. Successful exploitation results in complete takeover of Portable Clusterware and can extend impact to additional products through a scope change. Affected releases include Oracle Database Server versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. Oracle addressed the issue in the August 2026 Critical Patch Update.

Critical Impact
An adjacent-network attacker with no credentials can take over Portable Clusterware and pivot to impact additional connected Oracle Database products.

Affected Products

Oracle Database Server, Portable Clusterware component, versions 19.3 – 19.32
Oracle Database Server, Portable Clusterware component, versions 21.3 – 21.23
Oracle Database Server, Portable Clusterware component, versions 23.4.0 – 23.26.3

Discovery Timeline

2026-08-18 - CVE-2026-71064 published to the National Vulnerability Database (NVD)
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-71064

Vulnerability Analysis

The vulnerability affects Portable Clusterware, the component responsible for coordinating database cluster nodes over the private interconnect. An attacker positioned on the adjacent network segment attached to the cluster hardware can exploit the flaw without authentication or user interaction. Because the vulnerability triggers a scope change, a successful attack does not remain confined to Portable Clusterware. The attacker gains control of cluster coordination services, which brokers trust and communication for database nodes and adjacent products. NVD classifies the weakness under [CWE-284: Improper Access Control].

Root Cause

Oracle has not published implementation-level details for the flaw. Based on the CWE-284 classification and the adjacent-network attack profile, the root cause is improper access control on the Portable Clusterware communication channel. The component accepts privileged operations from peers on the interconnect segment without adequate authentication or authorization checks. This design assumption breaks when an attacker gains L2 adjacency to the cluster interconnect.

Attack Vector

Exploitation requires access to the physical communication segment attached to the cluster hardware, typically the private interconnect VLAN used for Real Application Clusters (RAC) traffic. An attacker on that segment sends crafted cluster protocol traffic to Portable Clusterware. No credentials, prompts, or user actions are needed. Successful exploitation compromises confidentiality, integrity, and availability of Portable Clusterware and, through scope change, of additional cluster-attached products.

No public proof-of-concept exploit code is available. The vulnerability mechanism is described in prose only; consult the Oracle Security Alert for August 2026 for vendor guidance.

Detection Methods for CVE-2026-71064

Indicators of Compromise

Unexpected hosts or MAC addresses appearing on the RAC private interconnect VLAN
Anomalous Cluster Ready Services (CRS) or Grid Infrastructure log entries showing unauthenticated peer join attempts
Unexpected cluster reconfiguration events, node evictions, or resource restarts not correlated with maintenance
New or modified operating system accounts, oracle-owned processes, or SUID binaries on cluster nodes

Detection Strategies

Baseline the set of authorized hosts on the interconnect segment and alert on any new L2 neighbors
Ingest $GRID_HOME/log/<node>/crsd/, cssd/, and evmd/ logs into a SIEM and search for authentication failures or protocol anomalies
Correlate cluster resource state changes with authenticated administrator sessions to surface unattributed activity

Monitoring Recommendations

Monitor switch port MAC tables and DHCP leases on interconnect VLANs for previously unseen endpoints
Alert on outbound connections from database nodes to non-cluster destinations, which can indicate post-exploitation pivoting
Track version and patch level of Portable Clusterware across all cluster nodes and flag unpatched hosts

How to Mitigate CVE-2026-71064

Immediate Actions Required

Apply the Oracle August 2026 Critical Patch Update to all Oracle Database Server installations running affected Portable Clusterware versions
Inventory all RAC and Grid Infrastructure deployments to confirm patch coverage across every cluster node
Restrict physical and logical access to the cluster interconnect segment to authorized cluster nodes only
Review recent cluster logs for signs of pre-patch exploitation before returning nodes to production

Patch Information

Oracle released fixes for CVE-2026-71064 in the August 2026 Critical Patch Update. Refer to the Oracle Security Alert for August 2026 for the applicable patch identifiers and prerequisites for versions 19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3. Apply patches to all cluster nodes and follow Oracle's documented rolling patch procedure to avoid extended downtime.

Workarounds

Isolate the cluster private interconnect on a dedicated VLAN with no routing to user or management networks
Enforce switch port security, 802.1X, or MAC filtering on interconnect ports to prevent unauthorized L2 attachment
Restrict physical access to the switches, cabling, and hosts that carry cluster interconnect traffic
Monitor and alert on any new device attaching to the interconnect segment until patches are applied

bash

# Verify Portable Clusterware / Grid Infrastructure patch level on each node
$GRID_HOME/OPatch/opatch lspatches
crsctl query crs releaseversion
crsctl query crs activeversion -f

# Restrict the private interconnect to known cluster node MAC addresses (example, Cisco IOS)
interface range GigabitEthernet1/0/1 - 4
 switchport mode access
 switchport access vlan 200
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation restrict