Oracle Database Server: Remote takeover via RDBMS component (DBMS_VECTOR)
Summary
A vulnerability in the RDBMS component of Oracle Database Server 23ai (versions 23.4.0 to 23.26.3) allows an attacker with a low-privileged database account holding the DBMS_VECTOR privilege to compromise the database over Oracle Net. Successful exploitation can lead to full takeover of the RDBMS, affecting confidentiality, integrity and availability. The attack requires valid database credentials and network access to the listener, and it is not unauthenticated. The vulnerability is listed in Oracle's October 2026 Critical Patch Update.
Affected
- Oracle Database Server, RDBMS component, versions 23.4.0 through 23.26.3 (23ai line)
Fixed in
- Fix provided with the October 2026 Critical Patch Update (CPU391). Unknown: specific fixed release number for 23ai.
Workaround
- Unknown. No vendor workaround identified.
- Interim measure (not from vendor): restrict Oracle Net access to the listener (port 1521 by default) to known application and admin hosts.
- Interim measure (not from vendor): review and revoke unneeded DBMS_VECTOR privileges.
Exploitation
- Exploited in the wild: no evidence found.
- CISA KEV: not listed.
- CISA SSVC: exploitation none, automatable no.
- Public proof of concept: none found; this is not proof that none exists.
Our recommendation
- Check whether you operate Oracle Database 23ai between 23.4.0 and 23.26.3, starting with ERP and finance systems.
- Schedule the October 2026 CPU patch for affected databases using CPU391 and the Oracle advisory.
- Confirm the Oracle listener is not reachable from the internet or untrusted networks.
- Review which accounts hold DBMS_VECTOR privileges and remove those not needed.
- Monitor database accounts for unexpected activity.
- Re-check NVD and the Oracle advisory for final CVSS and CWE data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 Critical Patch Update www.oracle.com
- Oracle Security Alerts www.oracle.com
- Oracle blog: October 2026 Critical Patch Update released blogs.oracle.com
- NVD/CNA data via Vulners vulners.com
- OpenCVE: CVE-2026-91499 app.opencve.io
- Waratek: Oracle October 2026 CPU waratek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:26.
Original description (NVD)
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.