CVE-2026-71062

Received Received - Intake

Authentication Bypass in Oracle Database RDBMS

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-71062

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	database_server	From 23.4.0 (inc) to 23.26.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0 to 23.26.3. It allows a low-privileged attacker with authenticated access to compromise the database via Oracle Net. Successful exploitation can lead to full takeover of the RDBMS.

Detection Guidance

Detection requires checking Oracle Database Server versions 23.4.0 to 23.26.3. Verify installed versions using Oracle utilities like SQL*Plus with SELECT * FROM v$version or check Oracle home directory versions. Network monitoring for unusual Oracle Net traffic may also help.

Impact Analysis

An attacker could gain control of the database, leading to unauthorized access, data theft, or manipulation. This could disrupt database operations and compromise sensitive information stored within.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of regulated data, violating compliance requirements such as GDPR or HIPAA. Organizations may face legal penalties or reputational damage if exploited.

Mitigation Strategies

Apply Oracle's latest security patches immediately. Restrict network access to Oracle Net via firewalls. Limit privileges for authenticated users to reduce attack surface. Monitor for suspicious database activity.

Hi! I’m here to help you understand CVE-2026-71062. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70