Oracle Trusted Answer Search: Remote takeover via Oracle Net in PL/SQL package
Summary
A flaw in the PL/SQL package of Oracle Trusted Answer Search version 26.1 allows an attacker with low privileges and network access via Oracle Net to compromise the product. Successful exploitation can lead to a full takeover with high impact on confidentiality, integrity and availability, and the scope change means other products may also be affected. The CVSS base score is 9.9 (critical). Exploitation requires a valid low-privileged account, but this barrier may be weak where accounts are shared or poorly managed.
Affected
- Oracle Trusted Answer Search, version 26.1
- Patch availability document: Database
Fixed in
Unknown. Check Oracle's October 2026 Critical Patch Update advisory and its patch availability document for the fixed build.
Workaround
Unknown. No vendor workaround was found. Generic options: restrict Oracle Net listener access to known application servers and limit and audit low-privileged database accounts, after confirming these with Oracle.
Exploitation
- Exploited in the wild: no evidence found, status unknown.
- Public proof of concept: none found.
- The CVE record is only days old.
Our recommendation
- Check whether Oracle Trusted Answer Search is installed at all.
- If installed, restrict Oracle Net access to trusted hosts and review low-privileged database accounts.
- Apply the Oracle patch once the fixed version is confirmed.
- Also check the related CVE-2026-101498 (CVSS 8.1, no authentication required) at the same time.
- Monitor for exploitation reports and a CISA KEV listing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle October 2026 Critical Patch Update advisory www.oracle.com
- Vulners NVD mirror CVE-2026-101503 vulners.com
- Strix CVE summary CVE-2026-101503 www.strix.ai
- Vulners NVD mirror CVE-2026-101498 (related) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:10.
Original description (NVD)
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search. While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.