Description

Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Portable Clusterware executes to compromise Portable Clusterware. While the vulnerability is in Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Portable Clusterware. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-18T21:18:06.193Z",
  "pubdate": "2026-08-18T21:18:06.193Z",
  "executiveSummary": "A critical vulnerability affects the Portable Clusterware component of the Oracle Database Server, specifically impacting supported versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3.\nThis flaw allows an unauthenticated attacker to compromise the Portable Clusterware through the physical communication segment attached to the underlying hardware.\nSuccessful exploitation of this vulnerability results in a complete takeover of the Portable Clusterware component and introduces a scope change, meaning attacks may significantly impact additional products beyond the immediate vulnerable component.\nThe vulnerability carries a maximum CVSS 3.1 Base Score of 9.6, indicating severe impacts across confidentiality, integrity, and availability.\nExploitation is categorized as easy, requiring low attack complexity with no privileges or user interaction needed, though it strictly demands adjacent network access via the physical communication segment.",
  "technicalDetails": "The vulnerability resides within the Portable Clusterware component of the Oracle Database Server across versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3.\nThe attack vector is classified as adjacent (AV:A), meaning the attacker must have direct access to the physical communication segment attached to the hardware hosting the Portable Clusterware execution environment.\nThe attack complexity is low (AC:L), and the vulnerability requires zero privileges (PR:N) as well as no user interaction (UI:N), enabling rapid and direct exploitation by unauthorized entities sharing the local communication medium.\nThe attack flow proceeds as follows: an unauthenticated threat actor positioned on the adjacent physical communication segment interacts with the vulnerable interfaces of the Portable Clusterware. Due to insufficient input validation, authentication enforcement, or boundary checks within the component, the attacker transmits crafted payloads across the network segment.\nUpon receipt, the vulnerable component processes the malicious payload, leading to memory corruption, logic bypass, or unauthorized command execution within the context of the Portable Clusterware process.\nBecause of the elevated privileges under which cluster management components operate, successful exploitation yields a complete takeover of the Portable Clusterware.\nFurthermore, the vulnerability exhibits a scope change (S:C), signifying that the compromise of the Portable Clusterware extends beyond its security boundary, potentially allowing the adversary to pivot, escalate privileges, or impact additional co-located products and underlying operating system resources.\nThe resulting impact spans total loss of confidentiality, integrity, and availability (C:H/I:H/A:H) for the affected systems."
}