Threats Tagged 'cve-2026-71102'

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 addressing multiple vulnerabilities across a wide range of Oracle Database products and related software. The update includes 943 security patches targeting Oracle Database Server, Essbase, Autonomous Health Framework, Application Testing Suite, and many other Oracle product families. The vulnerabilities include issues classified under CWE-770, CWE-416, CWE-476, and CWE-863. Oracle strongly recommends applying these patches promptly to mitigate risks, as some vulnerabilities have been subject to attempted exploitation in the wild. The advisory emphasizes staying on actively supported versions and applying patches without delay.

CVE-2026-71102 is a critical vulnerability in the Portable Clusterware component of Oracle Database Server. It affects versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized creation, deletion, or modification access to critical or all Portable Clusterware accessible data. Additionally, the vulnerability allows causing a hang or frequent crashes, resulting in a complete denial of service. The CVSS 3.1 base score is 9.1, indicating high severity with integrity and availability impacts. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities, and strongly recommends applying patches promptly.