---
id: "CVE-2026-101498"
kind: "vulnerability"
aliases: ["CVE-2026-101498"]
title: "Oracle Trusted Answer Search: PL/SQL flaw lets unauthenticated network attacker take over"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle", "oracle-trusted-answer-search", "plsql", "vendor"]
not_affected_if: ["product-not-deployed"]
published_at: "2026-10-20T22:17:58+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:06:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101498", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Trusted Answer Search: PL/SQL flaw lets unauthenticated network attacker take over

Oracle Trusted Answer Search 26.1 has a flaw in its PL/SQL package that can be reached over Oracle Net. An unauthenticated attacker with network access can compromise the product and take it over, per the CVSS 8.1 score.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether Oracle Trusted Answer Search version `26.1` is deployed
- Confirm whether the Oracle Net listener is reachable from untrusted networks
- unknown for other exposure checks: the sources do not say

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle Trusted Answer Search (the sources do not name the patched version)
- Restrict Oracle Net listener access to trusted networks until patched

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101498

## From the sources

Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_