This vulnerability in Oracle Database Server's Portable Clusterware component allows an unauthenticated attacker with physical communication segment access to compromise the component. The vulnerability affects multiple supported versions across three major release series (19.x, 21.x, and 23.x). The attack surface requires physical access to the communication segment, but no authentication or user interaction is needed. The vulnerability's scope change means that exploitation could affect other Oracle products dependent on Portable Clusterware. The CVSS 3.1 vector indicates attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, scope changed, and high impacts on confidentiality, integrity, and availability.

Successful exploitation results in complete takeover of the Portable Clusterware component, potentially affecting the confidentiality, integrity, and availability of Oracle Database Server and other related Oracle products. The scope change indicates that the impact extends beyond Portable Clusterware itself, potentially compromising additional Oracle products that rely on it.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to affected versions. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or 'no action required' statements are provided; patching is the primary remediation.