Oracle Database Server CVE-2026-71100

No authentication is required and no special client-side configuration is needed - the vulnerability is exploitable by any host that can reach the Oracle Net listener over the network (default TCP 1521). The attack is limited to hosts with network connectivity to the listener port; if the listener is firewalled to trusted clients only, exploitation is blocked at the network layer. The vulnerability is confirmed as affecting only specific version ranges: 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3; systems running versions outside these ranges or already patched to the August 2026 CPU are not affected. Impact is bounded to read access of a subset of RDBMS-accessible data - no write, delete, or availability impact applies, limiting the exploitability incentive for some threat actors but not for data theft or reconnaissance objectives.

The CVSS 3.1 base score of 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequence. However, several factors elevate practical concern: the attack vector is network-accessible (AV:N), attack complexity is low (AC:L), and no privileges or user interaction are required (PR:N/UI:N), meaning any host that can reach the Oracle Net listener port (default TCP 1521) is a potential source of exploitation. The 'Authentication Bypass' tag is the most significant signal - pre-auth data disclosure on a database server can expose table metadata, schema names, or partial row data depending on what the vulnerable code path returns, even if the volume is described as 'a subset.' EPSS data is not provided in the input, limiting probabilistic exploitation assessment. No KEV listing means active exploitation is not confirmed by CISA, and no POC is referenced - consistent with a freshly disclosed Oracle CPU patch. Even a mid-sized municipal IT team in kalisz managing Oracle deployments across multiple environments should treat this as a patch-cycle priority given the zero-auth network accessibility, even if the confidentiality impact appears bounded. The primary counterweight to urgency is the limited impact scope: only a subset of data is disclosed, and no integrity or availability impact applies.

An attacker with network reachability to the Oracle Net listener port (TCP 1521 or configured equivalent) sends a crafted Oracle Net protocol request that triggers the pre-authentication code path, bypassing identity validation and receiving a partial data response from the RDBMS. No credentials, client software configuration, or victim interaction are required - a raw TCP client implementing the TNS handshake is sufficient. No public proof-of-concept has been identified at time of analysis, but the low complexity and zero-auth nature make independent rediscovery plausible once the CPU patch diff is analyzed.