Security readout for executives and security teams
Plain-English summary
A nearby, unauthenticated attacker on the same physical communication segment could take control of Oracle Portable Clusterware. A successful attack could expose or alter data, disrupt availability, and affect additional products. Internet access is not required, but network proximity is.
Executive priority
Treat as an urgent remediation program for exposed affected clusters. Takeover could create operational outages and broader product impact. Prioritize environments with weak segment isolation, while avoiding claims of ongoing attacks unsupported by current evidence.
Technical view
CVE-2026-71064 is a CWE-284 authorization vulnerability affecting Portable Clusterware in Oracle Database Server versions 19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3. It requires adjacent-network access, but no privileges or user interaction. Oracle reports scope change and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is highest where affected Portable Clusterware communicates over segments reachable by untrusted devices, compromised hosts, contractors, or insufficiently isolated administrative networks. Confirm installed component versions and actual segment access.
Exploitation context
The CVSS score is 9.6 because exploitation is described as easy, unauthenticated, and capable of takeover. The attacker must access the attached physical communication segment. The provided sources do not establish active exploitation, and the CVE is not listed as KEV.
Researcher notes
The published vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Public details identify improper authorization and takeover impact but do not describe the vulnerable operation, protocol, indicators, or exploitation method. Scope-change consequences beyond Portable Clusterware remain unspecified.
Mitigation direction
- Check Oracle's advisory for version-specific patches or supported remediation guidance.
- Prioritize affected clusterware environments sharing segments with untrusted or broadly accessible systems.
- Restrict communication-segment access to explicitly authorized cluster nodes and administration systems.
- Monitor Oracle guidance for advisory updates or additional affected-product information.
Validation and detection
- Inventory Oracle Database Server and Portable Clusterware versions across all environments.
- Compare detected versions with 19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3.
- Map every system and user capable of reaching each clusterware communication segment.
- Verify vendor-recommended remediation is applied and recorded for each affected installation.
- Review network telemetry for unexpected systems communicating with Portable Clusterware segments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-71064 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H2.86oracleVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference, oracle · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.