A critical-severity (CVSS 9.9) vulnerability in the PLSQL package component of Oracle Trusted Answer Search 26.1 lets a low-privileged attacker with network access take over the product, and the impact can reach other products.
What Is It
CVE-2026-101503 is a vulnerability in Oracle Trusted Answer Search, in its PLSQL package component. Oracle describes it as easily exploitable. An attacker needs network access via Oracle Net and low-level privileges to compromise the product.
Oracle says a successful attack "can result in takeover of Oracle Trusted Answer Search." The vulnerability has a scope change, which means attacks may significantly affect other products beyond the vulnerable component.
The NVD record was published on 2026-10-20 and currently has a status of "Received." Oracle ([email protected]) is the source.
Why It Matters
The CVSS 3.1 vector, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, describes a serious exposure:
- Network-reachable (AV:N): reachable over Oracle Net
- Low attack complexity (AC:L): no special conditions needed
- Low privileges required (PR:L): the attacker needs some level of authenticated access, though the advisory does not say which accounts or roles qualify
- No user interaction (UI:N)
- Scope changed (S:C): the impact can extend beyond Trusted Answer Search
- High impact to confidentiality, integrity and availability
The score is 9.9 (CRITICAL), with an exploitability subscore of 3.1 and an impact subscore of 6.0. Because only low privileges are required, an attacker holding low-privileged credentials, such as stolen or compromised ones, may be able to take over the product. Oracle has not published details of exactly which privileges are needed.
Exploitation status: The supplied CISA KEV data has no entry for this CVE, so CISA does not currently confirm active exploitation.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Trusted Answer Search
- Component: PLSQL package
- Affected version: 26.1 (the supported version listed as affected)
The NVD record has no CPE entries yet.
Patch Status
NVD's only reference is Oracle's October 2026 Critical Patch Update security alert. Organizations running Oracle Trusted Answer Search 26.1 should read that advisory for fix details and apply Oracle's remediation as soon as possible. The CVE is not in KEV, so no CISA-mandated required action or due date applies at this time.
Until the patch is applied, consider limiting Oracle Net access to the affected systems and reviewing which low-privileged accounts can reach them, since those are the conditions an attacker needs.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-101503
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)