Oracle Trusted Answer Search: Unauthenticated takeover via Oracle Net
Summary
Oracle Trusted Answer Search version 26.1 contains a vulnerability in its PL/SQL package. An unauthenticated attacker with network access via Oracle Net can compromise the product, which can result in a takeover with impacts on confidentiality, integrity and availability. Exploitation is difficult (high attack complexity), and the CVSS 3.1 base score is 8.1. No exploitation or public proof of concept was known at the time of research.
Affected
- Oracle Trusted Answer Search 26.1
Fixed in
- Unknown. Oracle lists the fix in the October 2026 Critical Patch Update; the exact patch number was not verified.
Workaround
- No vendor workaround known.
- If patching cannot be applied immediately: restrict Oracle Net listener access to known clients (generic hardening, effect for this CVE not verified).
Exploitation
- No exploitation reported as of publication; not in the CISA KEV catalog as of 21 October 2026.
- No public proof of concept found.
Our recommendation
- Check whether any system runs Oracle Trusted Answer Search 26.1. If not, close the item.
- If yes: confirm that the Oracle Net listener is not reachable from the internet, apply the October 2026 CPU patch together with the other October 2026 CVEs (for example CVE-2026-101501 and CVE-2026-101503), and verify the fixed build in Oracle's patch availability document.
- Recheck CISA KEV and vendor feeds, as the status may change.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- Oracle Security Alerts www.oracle.com
- NVD record mirror (Vulners) vulners.com
- CNA data mirror (Strix) www.strix.ai
- Brandefense analysis of October 2026 CPU brandefense.io
- Waratek analysis of October 2026 CPU waratek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:28.
Original description (NVD)
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search. Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.