CVE-2026-71064 is a vulnerability in Oracle Database Server's Portable Clusterware component. It affects versions 19.3 to 19.32, 21.3 to 21.23, and 23.4.0 to 23.26.3. The flaw allows an unauthenticated attacker with physical access to the communication segment of the hardware running Portable Clusterware to compromise the component. The vulnerability's scope extends beyond Portable Clusterware, potentially affecting other Oracle products. The CVSS 3.1 score is 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating a critical risk with high impact on confidentiality, integrity, and availability. Oracle's advisory confirms the availability of patches as part of their August 2026 Critical Security Patch Update and urges customers to apply them without delay.

Successful exploitation of this vulnerability can result in complete takeover of the Portable Clusterware component, which may lead to significant impact on additional Oracle products due to scope change. The vulnerability affects confidentiality, integrity, and availability at a high level, as reflected by the CVSS score of 9.6. An attacker does not require authentication but must have access to the physical communication segment attached to the hardware where Portable Clusterware runs.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and not delaying patch application. No alternative mitigations or 'no action required' statements are provided by the vendor advisory.