Oracle OLAP: Privilege escalation via DBMS_AW allowing takeover of OLAP component
Summary
A vulnerability in the OLAP component of Oracle Database Server affects supported versions 19.3 to 19.32, 21.3 to 21.23 and 23.4.0 to 23.26.3. An attacker with a low-privileged database account that holds the DBMS_AW privilege and network access to Oracle Net can compromise the OLAP component. Successful exploitation could result in full takeover of Oracle OLAP, with high impact on confidentiality, integrity and availability (CVSS 3.1 8.8).
Affected
- Oracle Database Server, OLAP component
- Versions 19.3 to 19.32
- Versions 21.3 to 21.23
- Versions 23.4.0 to 23.26.3
Fixed in
- Unknown. Fixed patch numbers were not found in the available sources; check the Oracle October 2026 Critical Patch Update advisory and My Oracle Support for the patch matching each installed version.
Workaround
- No vendor workaround identified.
- Confirm whether the OLAP option is installed and in use.
- Restrict Oracle Net access (listener, port 1521 by default) to known application and administration hosts.
- Review accounts holding DBMS_AW and remove the privilege where it is not needed.
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no.
- No public proof of concept found.
Our recommendation
- Apply the October 2026 Oracle Critical Patch Update fix matching your installed versions, prioritising databases with OLAP in use and exposed listeners.
- Until patched, restrict listener access and review DBMS_AW grants.
- Check whether the OLAP option is installed; if not, exposure is lower.
- Monitor database audit logs for unusual OLAP or DBMS_AW activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 advisory www.oracle.com
- Oracle Security Alerts index www.oracle.com
- NVD/CNA CVE data mirror (OpenCVE) app.opencve.io
- Vulners CVE record vulners.com
- VulDB entry vuldb.com
- Third-party CPU summary (Breach Signal) breach-signal.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:22.
Original description (NVD)
Vulnerability in the Oracle OLAP component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_AW privilege with network access via Oracle Net to compromise Oracle OLAP. Successful attacks of this vulnerability can result in takeover of Oracle OLAP. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.