This vulnerability in Oracle Database Server's Portable Clusterware component allows an unauthenticated attacker with physical network segment access to compromise the component. The affected versions explicitly include 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. The vulnerability has a CVSS 3.1 score of 9.6, reflecting critical impact on confidentiality, integrity, and availability, and a scope change affecting other Oracle products. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 patches. No specific exploit code is reported in the wild. Oracle strongly advises applying patches promptly to mitigate risk.

Successful exploitation can result in complete takeover of the Portable Clusterware component, compromising confidentiality, integrity, and availability. Due to scope change, other Oracle products dependent on or integrated with Portable Clusterware may also be significantly impacted. The vulnerability requires physical access to the communication segment, limiting remote exploitation but still posing a critical risk in affected environments.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to affected Oracle Database Server versions. No alternative mitigations or temporary fixes are indicated. Maintaining up-to-date patches is the primary remediation.