CVE-2026-71100: Oracle Database Information Disclosure

CVE-2026-71100 Overview

CVE-2026-71100 is an access control weakness [CWE-284] in the Relational Database Management System (RDBMS) component of Oracle Database Server. An unauthenticated attacker with network access via Oracle Net can exploit the flaw to gain unauthorized read access to a subset of RDBMS-accessible data. The vulnerability affects Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Oracle rates the confidentiality-only issue with a CVSS 3.1 Base Score of 5.3. No integrity or availability impact is reported.

Critical Impact
Remote, unauthenticated attackers reachable via Oracle Net can read a subset of database data without any user interaction or credentials.

Affected Products

Oracle Database Server 19.3 through 19.32
Oracle Database Server 21.3 through 21.23
Oracle Database Server 23.4.0 through 23.26.3

Discovery Timeline

2026-08-18 - CVE-2026-71100 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database
Vendor advisory - Published in the Oracle Security Alert

Technical Details for CVE-2026-71100

Vulnerability Analysis

The flaw resides in the RDBMS component of Oracle Database Server and is classified under Improper Access Control [CWE-284]. An attacker reaches the vulnerable code path over Oracle Net, the network protocol used by clients to communicate with the database listener. Exploitation requires no authentication, no privileges, and no user interaction.

The attack surface is limited to confidentiality. Successful exploitation returns a subset of data that the RDBMS holds, but does not modify records, corrupt storage, or degrade availability. The impact scope remains within the RDBMS itself and does not cross into other Oracle components. Oracle marks the vulnerability as easily exploitable, indicating that reproducible attack conditions do not require unusual configurations. The current EPSS probability for exploitation in the next 30 days is 0.299%.

Root Cause

Access control checks inside the RDBMS component do not fully enforce the boundary between unauthenticated network callers and protected data structures. Because the enforcement gap is reachable through the standard Oracle Net listener path, the vulnerable logic executes before proper session-level authorization is applied to the caller's request.

Attack Vector

An attacker sends crafted requests over Oracle Net to a reachable Oracle Database listener. The RDBMS component processes the request without requiring valid credentials and returns data that should be restricted. Attackers positioned on internal networks, or on any network segment where the listener is exposed, can invoke the code path directly. No verified public proof-of-concept exploit is available. Refer to the Oracle Security Alert for vendor-supplied technical detail.

Detection Methods for CVE-2026-71100

Indicators of Compromise

Unusual volume of Oracle Net connections from unauthenticated or unexpected source IPs to database listener ports (default TCP/1521).
Read-heavy query patterns originating from sessions that never completed a standard authentication handshake.
Listener log (listener.log) entries recording repeated connection attempts from hosts outside the approved application tier.

Detection Strategies

Enable and centralize Oracle Database audit trails to capture data access events and correlate them with authenticated session identifiers.
Baseline expected client hosts communicating over Oracle Net and alert on new or unexpected source addresses reaching listener ports.
Monitor for anomalous SELECT patterns or metadata queries executed against sensitive schemas without an associated authenticated user context.

Monitoring Recommendations

Forward listener.log, unified audit records, and network flow data from database subnets into a SIEM for correlation.
Track connections to TCP/1521 and any custom Oracle Net ports for volume, geography, and time-of-day anomalies.
Review database session views such as V$SESSION and V$SESSION_CONNECT_INFO for sessions that lack a valid schema or authentication method.

How to Mitigate CVE-2026-71100

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected 19.x, 21.x, and 23.x database instances.
Inventory every Oracle Database Server instance and confirm patch level against the fixed versions published by Oracle.
Restrict network reachability of Oracle Net listeners to authorized application hosts using firewall rules and Oracle TCP.VALIDNODE_CHECKING.
Rotate any database credentials or secrets that may have been exposed through unauthorized reads while the system was unpatched.

Patch Information

Oracle addressed CVE-2026-71100 in the August 2026 Critical Patch Update. Patched builds must be installed on Oracle Database Server 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Refer to the Oracle Security Alert for the specific patch identifiers matching each supported release and platform.

Workarounds

Block direct network access to Oracle Net listener ports from untrusted networks until patches are applied.
Configure sqlnet.ora node-list restrictions (TCP.INVITED_NODES) to allow connections only from known application servers.
Deploy a database firewall or network access control list between client subnets and database servers to filter unauthenticated traffic.

bash

# Example sqlnet.ora restriction limiting Oracle Net access to known hosts
TCP.VALIDNODE_CHECKING = YES
TCP.INVITED_NODES = (10.10.20.15, 10.10.20.16, appserver01.example.local)
TCP.EXCLUDED_NODES = (0.0.0.0/0)