External risk intelligence

Oracle Portable Clusterware Integrity and Availability Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-71102

The vulnerability affects the Oracle Portable Clusterware component, which requires HTTP network access. While this component is typically intended for internal database cluster management rather than public-facing services, network-level accessibility makes it plausibly reachable if misconfigured or exposed in specific network environments.

Oracle Database Server

19.3 to 19.3221.3 to 21.2323.4.0 to 23.26.3

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Database Server's Portable Clusterware component, potentially impacting supported versions. This issue is easily exploitable by unauthenticated attackers over the network, posing a significant risk to data integrity and system availability, with the possibility of unauthorized data modification or complete service disruption.

Unauthenticated network access can harm Oracle clusterware.
Significant risk to data and service availability.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could compromise Oracle's Portable Clusterware by sending a specially crafted request over the network using HTTP. Since no authentication is required, an attacker could exploit this vulnerability to alter or delete critical data, or even cause the system to crash repeatedly.

Network access required.
HTTP request triggers vulnerability.
Unauthorized data access and denial of service.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access via HTTP could compromise the Portable Clusterware component of Oracle Database Server. This could lead to unauthorized modification or deletion of critical data, or a complete denial of service through frequent crashes.

Critical data could be affected.
Network access via HTTP could enable exposure.
Data integrity and service availability impacts are possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Portable Clusterware component is at risk, impacting data integrity and availability. The first step is to locate all instances of the affected Oracle Database Server versions, confirm their network exposure and criticality, identify the accountable owner, and then prioritize remediation based on risk.

Identify Oracle Database Server instances.
Verify network reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Portable Clusterware?

Oracle Portable Clusterware is a foundational component of the Oracle Database Server environment. It manages the coordination and communication across server nodes, ensuring that database instances remain highly available and synchronized. It acts as the backbone for cluster configurations, allowing multiple servers to operate as a single system, which is essential for large-scale data management.

How does this vulnerability affect system security?

This flaw allows an attacker to bypass authentication and interact with the component via HTTP. In security terms, this is a severe weakness that compromises both data integrity and system availability. It grants an unauthorized party the ability to modify or delete critical data held within the clusterware or force the service to crash, resulting in a denial-of-service condition.

Can any network request trigger this bug?

The vulnerability requires specific, crafted HTTP requests to be sent to the Portable Clusterware component. It is not triggered by standard, benign traffic or general database activity. An attacker must have network reachability to the component to initiate these malicious requests; without this specific network path, the vulnerability cannot be exploited.

Do I need to worry if my database is internal?

Halo Surface Signal notes that while Portable Clusterware is designed for internal cluster management, its reliance on HTTP makes it reachable if the component is misconfigured or inadvertently accessible from broader network segments. You should verify if your specific implementation has any network-level exposure, as internal does not always mean isolated from all network traffic.

What is the first step to address CVE-2026-71102?

Begin by inventorying your environment to locate all instances running the affected Oracle Database Server versions. Once identified, evaluate the network accessibility of these instances to determine if they are reachable in a way that aligns with the vulnerability's requirements. Engage the system owners to prioritize these assets for remediation based on their business criticality.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.