Oracle Trusted Answer Search: Unauthorized data access via Application expert UI
Summary
A flaw in the Application expert UI of Oracle Trusted Answer Search version 26.1 allows an authenticated low-privileged attacker with network access over HTTP to read, create, modify or delete data. Exploitation requires a second person, such as a user, to interact with the attack. The CVSS 3.1 base score is 8.7 (high), and the vulnerability can affect data beyond the product itself (scope change).
Affected
- Oracle Trusted Answer Search, version 26.1 (Application expert UI component)
Fixed in
Unknown. The vulnerability is listed in Oracle's October 2026 Critical Patch Update; the fixed build must be checked in the Oracle advisory.
Workaround
Unknown. Oracle's advisory excerpt lists no workaround.
Exploitation
- No known exploitation in the wild at the time of research (not listed in CISA KEV as checked on 21 October 2026).
- No public proof of concept found; this is not confirmed absent.
- EPSS 0.00353 (low).
Our recommendation
- Check whether Oracle Trusted Answer Search is in use and whether version 26.1 is running.
- Confirm whether the Application expert UI is reachable from the internet or only via VPN or SSO.
- Apply the fix from Oracle's October 2026 Critical Patch Update in the normal patch cycle.
- Until patched, restrict HTTP access to the Application expert UI and review accounts with access to it.
- Monitor logs for unusual data changes or deletions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert Advisory October 2026 CPU www.oracle.com
- CVE record CVE-2026-101505 (Vulners) vulners.com
- NVD record CVE-2026-101505 (Vulners) vulners.com
- Strix CVE entry CVE-2026-101505 www.strix.ai
- Oracle October 2026 Critical Patch Update blog blogs.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:21.
Original description (NVD)
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.