Description

Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Portable Clusterware executes to compromise Portable Clusterware. While the vulnerability is in Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Portable Clusterware. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-18T21:18:06.313Z",
  "pubdate": "2026-08-18T21:18:06.313Z",
  "executiveSummary": "A critical vulnerability affects the Portable Clusterware component of the Oracle Database Server, specifically impacting supported versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3.\nThis vulnerability is classified as an easily exploitable flaw that allows an unauthenticated attacker to achieve a complete system takeover of the Portable Clusterware component.\nThe exploitation vector requires the adversary to have direct access to the physical communication segment attached to the underlying hardware where the Portable Clusterware executes.\nAlthough the vulnerable code resides strictly within the Portable Clusterware component, successful exploitation exhibits a scope change, meaning that attacks can significantly impact additional co-located or dependent products.\nThe severity of this flaw is underscored by a CVSS 3.1 Base Score of 9.6, indicating maximum possible impacts across confidentiality, integrity, and availability.\nThe high risk profile demands immediate attention from enterprise security teams managing affected Oracle Database Server deployments, particularly in environments where physical network segments are insufficiently segregated or monitored.",
  "technicalDetails": "The vulnerability resides within the Portable Clusterware component of the Oracle Database Server across versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3.\nThe attack vector is categorized as adjacent (AV:A), requiring the attacker to be positioned on the physical communication segment attached to the hardware hosting the Portable Clusterware execution environment.\nAttack complexity is assessed as low (AC:L), meaning the exploitation mechanism does not require sophisticated race conditions, advanced cryptographic cracking, or complex bypassing of modern defensive mitigations.\nNo privileges (PR:N) and no user interaction (UI:N) are required for successful exploitation, allowing an unauthenticated adversary on the local physical network segment to initiate attacks directly against the vulnerable service.\nThe attack flow begins with the adversary gaining access to the physical communication segment attached to the target hardware.\nFrom this network vantage point, the attacker transmits specially crafted packets or payloads directly to the listening interfaces or communication channels utilized by the Portable Clusterware component.\nDue to insufficient validation, parsing errors, or insecure state handling within the vulnerable component, the malicious payload triggers memory corruption, logic flaws, or unauthorized command execution paths.\nBecause the vulnerability involves a scope change (S:C), successful exploitation breaks security boundaries, allowing the adversary to escalate privileges beyond the initial component context and potentially compromise the broader operating system environment and additional products running on the host.\nThe ultimate post-exploitation impact results in the complete takeover of the Portable Clusterware component, yielding high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), effectively granting the attacker full control over the targeted cluster services and associated data vectors."
}