Oracle Database Server: Improper access control in VPD component
Summary
The VPD (Virtual Private Database) component of Oracle Database Server contains an improper access control vulnerability (CWE-284). An attacker with a low-privileged database account that holds the CREATE TABLE privilege and network access via Oracle Net can compromise VPD row-level access control. Successful exploitation can lead to unauthorized read, creation, modification and deletion of data protected by VPD policies. The attack requires valid database credentials and does not need user interaction.
Affected
- Oracle Database Server 19.3 to 19.32
- Oracle Database Server 21.3 to 21.23
- Oracle Database Server 23.4.0 to 23.26.3
Fixed in
- Unknown. The fixed release is not confirmed for this CVE; verify the patch number in the Oracle October 2026 Critical Patch Update advisory before rollout.
Workaround
- No vendor workaround known. The advisory has no notes for this CVE.
- Restrict Oracle Net access (listener, port 1521 by default) to known application and admin hosts.
- Review and minimise accounts holding the CREATE TABLE privilege.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC rates exploitation as none and automatable as no.
- EPSS is about 0.003.
- No public proof of concept or exploit reports found.
Our recommendation
- Check whether Oracle Database Server 19.3 to 19.32, 21.3 to 21.23 or 23.4.0 to 23.26.3 is in use.
- Apply the October 2026 Oracle Critical Patch Update once the fixed release is confirmed, in the next maintenance window.
- Restrict Oracle Net exposure and review CREATE TABLE privileges and VPD policies.
- Re-check the NVD record, as its status may be outdated.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- Oracle Database Monthly News October 2026 blogs.oracle.com
- OpenCVE CVE-2026-91503 app.opencve.io
- Vulners CVE-2026-91503 vulners.com
- GBHackers: Oracle releases 1295 security patches gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:14.
Original description (NVD)
Vulnerability in the VPD component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.