Oracle Clusterware CVE-2026-71064

The attacker must have access to the physical communication segment (the cluster interconnect) attached to the hardware where Portable Clusterware runs - that Adjacent-network foothold is the exact prerequisite named by Oracle, not remote internet reachability. No authentication is required (PR:N) and no user interaction is needed (UI:N), and default installs of the affected 19c/21c/23ai lines running Portable Clusterware are in scope. The primary limiting factor is that exploitation is impossible without presence on the interconnect segment, so deployments that isolate the interconnect on a dedicated, access-controlled private network substantially raise the bar; version must fall within 19.3-19.32, 21.3-21.23, or 23.4.0-23.26.3.

The signals align toward genuine high priority rather than an inflated CVSS: the vector AV:A/AC:L/PR:N/UI:N combines no authentication, low attack complexity, and no user interaction, and the scope change plus full C/I/A impact drive the 9.6 base score. Oracle explicitly calls it 'easily exploitable,' which reinforces the low-complexity rating. The mitigating factor is the Adjacent (not Network) vector - an attacker must already have a foothold on the cluster interconnect segment, so this is not internet-facing spray-and-pray; an organization running the interconnect on an isolated VLAN with strict access control materially reduces exposure, while a mid-sized operator that shares the interconnect with general network segments should treat this as urgent. Countervailing signals: no EPSS score, POC, or KEV listing was provided, and EPSS/exploit-maturity data is simply absent here rather than low, so real-world exploitation likelihood cannot be quantified from the input and should be treated as unknown, not zero.

An attacker who has gained a foothold on a server or device sharing the Oracle RAC cluster interconnect segment sends crafted traffic to the Portable Clusterware protocol, requiring no credentials and no user interaction. Given the low complexity and scope change, the attacker takes over Clusterware and pivots to impact the databases and other products that trust the cluster layer. No public proof-of-concept is identified at time of analysis.