This vulnerability in Oracle Database Server's Portable Clusterware component allows an unauthenticated remote attacker to compromise the system via HTTP. Exploitation can lead to unauthorized modification of critical data and denial of service through hangs or crashes. The affected versions are 19.3 to 19.32, 21.3 to 21.23, and 23.4.0 to 23.26.3. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, reflecting network attack vector, low complexity, no privileges or user interaction required, with high impact on integrity and availability. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation allows unauthorized creation, deletion, or modification of critical or all Portable Clusterware accessible data, compromising data integrity. It also enables an attacker to cause hangs or frequent crashes, resulting in a complete denial of service, impacting availability. There is no confidentiality impact reported. The vulnerability is easily exploitable remotely without authentication.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches without delay and remain on actively supported versions. No additional mitigation steps are indicated by the vendor advisory.