Multiple vulnerabilities in Oracle Database Server (August 19, 2026)
Multiple vulnerabilities have been discovered in Oracle Database Server. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and data confidentiality breach.
CSIRTS triage
- What
- Multiple vulnerabilities in Oracle Database Server allow remote arbitrary code execution, denial of service, and data confidentiality breaches.
- Who is affected
- All deployments of Oracle Database Server are potentially vulnerable.
- Urgency
- Critical due to remote code execution capability affecting production database systems.
- Action
- Apply the latest Oracle Database Server security patches immediately to all database instances.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Database Server
Get an email when a new Database Server advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1047/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-710640.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-710620.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-710630.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-711000.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-711020.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-598890.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-71064 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-71062 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-71063 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-71100 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-71102 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-59889 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Keycloak: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0307 [1.00] [M/H] Vulnerabilities resolved in Oracle Database Productsncsc-nl
- high[NEW] [high] Oracle Database Server: Multiple vulnerabilitiescert-bund
- criticalCVE-2026-71102: Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versi…nvd
- mediumCVE-2026-71100: Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are af…nvd
- criticalCVE-2026-71064: Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versi…nvd
- criticalCVE-2026-71063: Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versi…nvd
- highCVE-2026-71062: Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are af…nvd
- medium[NEW] [medium] RealObjects PDFreactor: Multiple vulnerabilities enable unspecified attackcert-bund
- medium[NEW] [medium] FasterXML Jackson: Multiple vulnerabilitiescert-bund
- mediumGHSA-5gvw-p9qm-jgwh: jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deseriali…ghsa
- mediumCVE-2026-59889: jackson-databind contains the general-purpose data-binding functionality and tree-model for Ja…nvd
Recent advisories for Oracle Database Server
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Oracle Database Server: Multiple vulnerabilitiescert-bund · 2026-08-19
- criticalCVE-2026-71102: Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versi…nvd · 2026-08-18
- mediumCVE-2026-71100: Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are af…nvd · 2026-08-18
- criticalCVE-2026-71064: Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versi…nvd · 2026-08-18
- criticalCVE-2026-71063: Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versi…nvd · 2026-08-18
- highCVE-2026-71062: Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are af…nvd · 2026-08-18
More from CERT-FR Avis de sécurité
- unknownMultiple vulnerabilities in Oracle Virtualization (August 19, 2026)2026-08-19
- unknownMultiple vulnerabilities in Oracle Weblogic (August 19, 2026)2026-08-19
- unknownMultiple vulnerabilities in Axis products (August 19, 2026)2026-08-19
- unknownMultiple vulnerabilities in Google Chrome (August 19, 2026)2026-08-19
- unknownMultiple vulnerabilities in Oracle MySQL (August 19, 2026)2026-08-19