EUVD-2026-62045
GHSA-7r9w-hxhm-rf6w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Portable Clusterware HTTP interface
-
DeliverySend crafted unauthenticated request
-
ExploitTamper with or delete critical cluster data
-
ExecutionTrigger repeatable hang/crash
-
ImpactComplete DOS of clusterware
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The prerequisite is network reachability of the Oracle Portable Clusterware component's HTTP interface on an affected Database Server (19.3-19.32, 21.3-21.23, or 23.4.0-23.26.3); the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication, no privileges, and no user interaction are needed against a reachable instance. The practical limiting factor is exposure of that HTTP endpoint: Portable Clusterware management interfaces are commonly deployed on restricted cluster/back-end networks, so exploitation depends on the attacker being able to route to the service. There is no confidentiality impact (C:N) - the attack yields integrity tampering and denial of service only. |
| Impact | The signals align toward genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivial, unauthenticated, network-reachable exploitation, and the 9.1 score reflects both integrity and availability compromise. No EPSS value, POC, or KEV entry was supplied, so exploitation likelihood cannot be quantified from probability data - but absence of a public exploit does not lower the intrinsic ease of attack, and because this component underpins database cluster availability, even a mid-sized municipal IT team in ustka should treat this as urgent once the service is network-exposed. The main mitigating reality is deployment exposure: Clusterware management interfaces are typically on restricted/back-end networks rather than the public internet, which narrows the realistic attack surface. Net assessment: real, high-severity priority for anyone running affected versions with the Portable Clusterware HTTP interface reachable by untrusted networks; verify network exposure to right-size urgency, since CVSS assumes reachability that may not hold in segmented environments. |
| Exploit ScenarioDerived | An attacker who can reach the Portable Clusterware HTTP interface from the network sends a crafted unauthenticated request that modifies or deletes critical clusterware-managed data, or repeatedly triggers a hang/crash to take the database cluster offline. Because no authentication or user interaction is required and complexity is low, the request can be scripted for reliable, repeatable disruption. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote tampering and denial-of-service in Oracle Database Server's Portable Clusterware component lets an unauthenticated attacker reach the service over HTTP and manipulate or destroy critical cluster data, or force a complete, repeatable crash. Affected releases span 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, carrying a CVSS 3.1 base score of 9.1 driven purely by high Integrity and Availability impact (confidentiality is untouched). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (network, low complexity, no privileges, no user interaction) makes it a high-priority patch item.
RemediationAI
Apply the fixes in the Oracle August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html), which is the vendor advisory carrying the patch for the affected 19c, 21c, and 23ai release lines - patch available per vendor advisory, though a single exact fixed build number is not enumerated in the supplied data, so match the corrected release for your specific version from the CPU matrix. Until the CPU can be applied, restrict network reachability of the Portable Clusterware HTTP interface by placing cluster interconnect and management endpoints on an isolated/segmented network and blocking the relevant HTTP port from untrusted sources with host or network firewall rules; the trade-off is that overly aggressive filtering can disrupt legitimate cluster management and monitoring traffic, so scope rules to the component's ports and known administrative hosts. Because the vulnerability is unauthenticated, front-end authentication cannot be added as a workaround, making network isolation the primary compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Portable Clusterware is the clustering/high-availability layer bundled with Oracle Database Server (a portable variant of Oracle Grid Infrastructure/Clusterware) that coordinates node membership, resource management, and shared storage across database cluster nodes. The affected attack surface is an HTTP-reachable interface of this component (AV:N over HTTP per the CVSS vector), and the impact profile - unauthorized create/delete/modify of critical data plus a repeatable hang/crash - is consistent with missing authentication and/or improper input validation on a management or control endpoint. Oracle assigned no CWE, so the precise root-cause class (e.g., missing authentication, improper access control, or input-handling flaw) cannot be stated with certainty from the available data; the C:N/I:H/A:H shape indicates the flaw exposes state-changing and disruptive operations but not data disclosure.
Know when Database Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated network HTTP access with low complexity gives AV:N/AC:L/PR:N/UI:N; impact is high integrity tampering and full DOS with no data disclosure, so C:N/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Portable Clusterware. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Portable Clusterware accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Portable Clusterware. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Executive ViewAI
Oracle Database Server's Portable Clusterware component (versions 19.3-19.32, 21.3-21.23, 23.4.0-23.26.3) contains a critical vulnerability allowing unauthenticated attackers to remotely corrupt cluster data or force service crashes over HTTP, with no patch currently available. Organizations running affected versions face direct threats to database availability and data integrity, potentially triggering compliance violations and operational disruption. Immediate network isolation and access restrictions are required pending vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement strict network segmentation-restrict Clusterware listener ports to administrative subnets only, deny all inbound HTTP/HTTPS from untrusted networks; (2) Deploy WAF rules to filter malicious HTTP payloads targeting Clusterware endpoints; (3) Enable and monitor Clusterware audit logs for integrity violations and repeated access attempts; (4) Implement read-only or snapshot-based backups of cluster metadata outside the production database; (5) Establish automated alerts on cluster state changes and Clusterware process restarts; (6) Prepare and test database failover procedures to minimize downtime if an attack occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Database Server
View allThe TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.
The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 all
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv
An exploitable out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Datab
An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospik
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointe
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via v
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point
Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.
An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database
Exploit-DB