CVE-2026-71102: Oracle Database Server DOS Vulnerability

CVE-2026-71102 Overview

CVE-2026-71102 is a critical access control vulnerability in the Portable Clusterware component of Oracle Database Server. An unauthenticated remote attacker can exploit this flaw over HTTP without user interaction. Successful exploitation allows attackers to create, delete, or modify critical Portable Clusterware data. Attackers can also cause a hang or repeatable crash, resulting in complete denial of service.

The vulnerability affects Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Oracle addressed the issue in the August 2026 Critical Patch Update. The weakness is categorized as [CWE-284] Improper Access Control.

Critical Impact
An unauthenticated network attacker can tamper with or destroy Portable Clusterware data and crash the service, disrupting database cluster operations across all supported production versions.

Affected Products

Oracle Database Server versions 19.3 through 19.32
Oracle Database Server versions 21.3 through 21.23
Oracle Database Server versions 23.4.0 through 23.26.3

Discovery Timeline

2026-08-18 - CVE-2026-71102 published to the National Vulnerability Database
2026-08-20 - Last updated in the NVD database

Technical Details for CVE-2026-71102

Vulnerability Analysis

The vulnerability resides in the Portable Clusterware component of Oracle Database Server. Portable Clusterware provides the clustering foundation that coordinates node membership, resource management, and failover for Oracle Real Application Clusters (RAC) deployments.

The component exposes an HTTP-accessible interface that fails to enforce proper authorization on privileged operations. An attacker with network reachability to this interface can invoke functions that alter cluster state and data. No credentials, user interaction, or elevated privileges are required.

The impact profile focuses on integrity and availability. Confidentiality is not directly affected, but write access to clusterware data enables attackers to corrupt cluster configuration, delete resource definitions, or force a repeatable crash that halts the clusterware service entirely.

Root Cause

The root cause is improper access control [CWE-284] on network-exposed Portable Clusterware operations. The component does not validate that requests originate from authenticated, authorized cluster participants before executing state-changing actions. Any host that can reach the HTTP endpoint can invoke administrative functions.

Attack Vector

The attack path requires only HTTP network access to a vulnerable Oracle Database Server node running Portable Clusterware. An attacker sends crafted HTTP requests to the exposed clusterware interface to trigger unauthorized data modification or induce a service crash.

Because Portable Clusterware coordinates cluster-wide operations, a successful crash cascades into cluster instability, potentially taking dependent database instances offline. No public proof-of-concept exploit is available at the time of publication. The EPSS score is 0.416%, reflecting current predicted exploitation likelihood.

See the Oracle Security Alert August 2026 for vendor technical details.

Detection Methods for CVE-2026-71102

Indicators of Compromise

Unexpected HTTP requests to Portable Clusterware endpoints from hosts outside the cluster interconnect network
Unexplained modification, creation, or deletion of clusterware resource definitions and configuration entries
Repeated Portable Clusterware service crashes, hangs, or automatic restarts recorded in the Clusterware alert logs
Cluster node evictions or failover events not correlated with legitimate administrative activity

Detection Strategies

Inspect network flows for HTTP traffic destined to Portable Clusterware ports originating from non-administrative subnets
Correlate Grid Infrastructure alert logs (alert<nodename>.log, crsd.log, ohasd.log) with unexpected configuration changes
Baseline normal clusterware administrative activity and alert on out-of-band mutation operations
Monitor for repeated 5xx responses or connection resets against clusterware HTTP endpoints indicating crash conditions

Monitoring Recommendations

Forward Oracle Grid Infrastructure and Clusterware logs into a centralized SIEM for continuous review
Enable network flow logging on database subnets to identify unauthorized access to clusterware services
Alert on any change to Oracle Cluster Registry (OCR) or Voting Disk contents outside change windows
Track clusterware service uptime metrics and generate alerts on unplanned restart patterns

How to Mitigate CVE-2026-71102

Immediate Actions Required

Apply the August 2026 Oracle Critical Patch Update to all affected 19.x, 21.x, and 23.x Database Server instances
Restrict network access to Portable Clusterware HTTP endpoints so only trusted cluster interconnect hosts can reach them
Audit Portable Clusterware configuration and OCR contents for unauthorized changes since exposure began
Prioritize internet-exposed and DMZ-adjacent database clusters for immediate remediation

Patch Information

Oracle released fixes in the August 2026 Critical Patch Update. Administrators should review the Oracle Security Alert August 2026 advisory for patch identifiers matching their specific version and platform. Apply patches to all cluster nodes in a coordinated rolling update to preserve availability.

Workarounds

Place database cluster nodes behind a network segment that blocks external HTTP access to clusterware ports
Enforce host-based firewall rules (iptables, firewalld) permitting clusterware traffic only from peer cluster nodes
Deploy network-layer access control lists on switches or load balancers fronting the database tier
Disable or restrict any non-essential HTTP listeners exposed by the Grid Infrastructure stack

bash

# Example: restrict Portable Clusterware HTTP access to cluster interconnect subnet only
# Replace 10.10.20.0/24 with your actual private cluster interconnect subnet
firewall-cmd --permanent --zone=drop --add-source=0.0.0.0/0
firewall-cmd --permanent --zone=trusted --add-source=10.10.20.0/24
firewall-cmd --permanent --zone=trusted --add-port=<clusterware-http-port>/tcp
firewall-cmd --reload