CVE-2026-71100: Oracle Database Server Information Disclosure

CVE-2026-71100 Overview

CVE-2026-71100 is an information disclosure vulnerability in the Relational Database Management System (RDBMS) component of Oracle Database Server. The flaw allows an unauthenticated attacker with network access via Oracle Net to read a subset of RDBMS-accessible data. Oracle disclosed the issue in the August 2026 Critical Patch Update. The vulnerability is categorized under [CWE-284] Improper Access Control and affects widely deployed Oracle Database versions across the 19c, 21c, and 23ai release lines.

Critical Impact
Unauthenticated network attackers can obtain unauthorized read access to a subset of data stored in the Oracle RDBMS without user interaction.

Affected Products

Oracle Database Server versions 19.3 through 19.32
Oracle Database Server versions 21.3 through 21.23
Oracle Database Server versions 23.4.0 through 23.26.3

Discovery Timeline

2026-08-18 - CVE-2026-71100 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71100

Vulnerability Analysis

The vulnerability resides in the RDBMS component of Oracle Database Server, which handles core database operations and enforces access controls on stored data. An attacker reaches the vulnerable code path through Oracle Net, the network protocol used for client-to-database communication. Exploitation requires no credentials, no user interaction, and no elevated privileges.

Successful exploitation yields unauthorized read access to a subset of data managed by the RDBMS. The vulnerability does not permit modification of data or disruption of database availability. Confidentiality is the sole affected security property.

Oracle rates the exploitation complexity as low. The Exploit Prediction Scoring System places the near-term exploitation probability at 0.306% (23rd percentile), indicating no observed exploitation activity at the time of publication.

Root Cause

The underlying weakness is Improper Access Control [CWE-284] within the RDBMS component. Access decisions on a subset of database-accessible objects fail to properly verify the requester's identity or authorization, allowing anonymous Oracle Net clients to retrieve data that should require an authenticated session.

Attack Vector

Exploitation is remote and network-based. An attacker with reachability to the database listener over Oracle Net crafts requests that trigger the flawed access-control path in the RDBMS component. Because authentication is not required, any endpoint able to establish a TCP connection to the listener port (commonly 1521) is a potential source of exploitation.

Oracle has not published proof-of-concept code, and no public exploit is currently available. Technical specifics beyond the advisory summary are not disclosed. See the Oracle Security Alert for vendor guidance.

Detection Methods for CVE-2026-71100

Indicators of Compromise

Unauthenticated Oracle Net sessions originating from unexpected source addresses to the database listener on port 1521 or a customized listener port.
Unusual query patterns or bursts of read operations recorded in database audit logs without a corresponding authenticated session.
Connections from IP ranges outside the documented application-tier or administrative subnets.

Detection Strategies

Enable Oracle unified auditing and review AUDIT_TRAIL entries for anonymous or failed-login connections that are followed by successful data retrieval.
Inspect listener logs (listener.log) for connection attempts that do not correlate with known application service accounts.
Correlate network flow telemetry with database session records to identify Oracle Net traffic sourced from unauthorized network segments.

Monitoring Recommendations

Ingest Oracle listener logs, unified audit records, and network flow data into a centralized SIEM for cross-source correlation.
Alert on sudden increases in Oracle Net connections from previously unseen client addresses.
Baseline query volume per source host and flag statistical deviations that could indicate unauthenticated data extraction.

How to Mitigate CVE-2026-71100

Immediate Actions Required

Apply the August 2026 Oracle Critical Patch Update to all affected Database Server instances running versions 19.3-19.32, 21.3-21.23, or 23.4.0-23.26.3.
Inventory all Oracle Database Server deployments, including development, test, and disaster-recovery replicas, to ensure complete patch coverage.
Restrict network reachability of the database listener to trusted application and administrative subnets only.

Patch Information

Oracle addresses CVE-2026-71100 in the August 2026 Critical Patch Update. Administrators should download and apply the appropriate Release Update or bundle patch for their database version as documented in the Oracle Security Alert. Verify successful patch application by checking DBA_REGISTRY_SQLPATCH after installation.

Workarounds

Enforce network segmentation with firewall rules that limit Oracle Net connectivity to known application servers and administrative hosts.
Configure Oracle Net valid node checking via sqlnet.ora parameters TCP.VALIDNODE_CHECKING, TCP.INVITED_NODES, and TCP.EXCLUDED_NODES to restrict listener connections.
Deploy Oracle Database Firewall or an equivalent database-aware network control to inspect and filter unauthenticated traffic to the listener.

bash

# Example sqlnet.ora configuration to restrict listener access
TCP.VALIDNODE_CHECKING = yes
TCP.INVITED_NODES = (10.10.20.15, 10.10.20.16, 10.10.30.0/24)
TCP.EXCLUDED_NODES = (0.0.0.0/0)