CVE-2026-71102 is a vulnerability in Oracle Database Server's Portable Clusterware component that allows an unauthenticated attacker with network access via HTTP to compromise the system. The vulnerability enables unauthorized creation, deletion, or modification of critical data and can cause hangs or frequent crashes, resulting in a complete denial of service. Affected versions include 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. The CVSS 3.1 base score is 9.1, reflecting critical severity with impacts on integrity and availability. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among 943 patches but does not explicitly confirm patch availability for this specific issue. Customers are urged to apply security patches without delay to mitigate exploitation risks.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Portable Clusterware, compromising data integrity. Additionally, it can cause the Portable Clusterware component to hang or crash repeatedly, resulting in a complete denial of service and impacting availability. The vulnerability does not impact confidentiality according to the CVSS vector. No known exploits in the wild have been reported at this time.

Oracle strongly recommends that customers remain on actively supported versions and apply security patches promptly as provided in the August 2026 Critical Security Patch Update advisory. Although the advisory does not explicitly confirm patch availability for CVE-2026-71102, it contains numerous security fixes, and applying these updates is the best mitigation. Users should consult the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch information and installation instructions. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.