A critical (CVSS 9.9) vulnerability in the PL/SQL package of Oracle Trusted Answer Search 26.1 lets a low-privileged attacker with network access compromise the product and potentially affect other products.
What Is It
CVE-2026-101501 is a vulnerability in the PLSQL package component of Oracle Trusted Answer Search. Oracle describes it as easily exploitable. An attacker needs only low privileges and network access via Oracle Net to compromise Oracle Trusted Answer Search, and no user interaction is required.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H. This gives it a base score of 9.9 (CRITICAL), with an exploitability score of 3.1 and an impact score of 6.0.
Why It Matters
The scope is marked as changed. That means the vulnerability sits in Oracle Trusted Answer Search, but a successful attack may significantly affect other products. According to Oracle, a successful attack can lead to:
- Integrity (High): unauthorized creation, deletion or modification of critical data, or of all data that Oracle Trusted Answer Search can access
- Availability (High): a hang or frequently repeatable crash (complete DoS) of Oracle Trusted Answer Search
- Confidentiality (Low): unauthorized read access to a subset of the data Oracle Trusted Answer Search can access
The bar for attack is low: network reachable, low complexity, low privileges and no user interaction. Combined with the changed scope, any deployment exposed over Oracle Net is a high-priority target.
Exploitation status: CVE-2026-101501 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so the supplied sources do not confirm active exploitation. No CISA-mandated required action or due date applies at this time.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Trusted Answer Search
- Component: PLSQL package
- Affected version: 26.1 (the only supported version listed as affected)
NVD has not yet published CPE configuration data for this record. Its status is "Received", and it was published on 2026-10-20.
Patch Status
NVD's only reference for this CVE is Oracle's October 2026 Critical Patch Update security alert. Organizations running Oracle Trusted Answer Search 26.1 should check that advisory for fix availability and remediation guidance, and apply the relevant update. The supplied records do not include any further patch details. Until you can apply the update, limit Oracle Net access to the affected instance and review which accounts hold low-privilege access, since that is all an attacker needs.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-101501
- CISA Known Exploited Vulnerabilities Catalog (not listed as of publication)