{"id":"CVE-2026-101503","kind":"vulnerability","aliases":["CVE-2026-101503"],"related":[],"title":"Oracle Trusted Answer Search: PLSQL flaw lets low-privilege users take over","description":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Trusted Answer Search 26.1 has a PL/SQL package flaw (CVSS 9.9, scope change). A low-privileged account with Oracle Net access can take over the product, with impact that can reach other products. Fixed in the October 2026 Critical Patch Update. Oracle's public advisory names no fixed version. No exploitation or public PoC known.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Trusted Answer Search","fixed":[],"affected":"26.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle","oracle-database","oracle-trusted-answer-search","plsql","self-hosted","vendor"],"not_affected_if":["not-version-26.1"],"how_to_check":"Find your Trusted Answer Search version (the installer on Oracle's download page is 26.2). 26.1 is listed as affected. Whether 26.2 is affected or fixed is unclear from public pages, so treat it as in scope until the Oracle Database patch availability document says otherwise. Also check which accounts can execute the product's PL/SQL packages and which hosts can reach the Oracle Net listener.","fix":"Apply the October 2026 Critical Patch Update patch for Oracle Trusted Answer Search from the Database patch availability document on My Oracle Support (support contract needed). The fixed version number is unknown from public pages. Until patched, restrict Oracle Net access to trusted hosts and review execute privileges on the product's PL/SQL packages.","status":"open","published_at":"2026-10-20T22:17:59+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:56+00:00","updated_at":"2026-10-23T23:09:12+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:38:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Trusted Answer Search: PLSQL flaw lets low-privilege users take over","impact":"high","summary":"Oracle Trusted Answer Search version 26.1 has a flaw in its PLSQL package that a low-privileged user can trigger over Oracle Net from the network. Successful exploitation gives the attacker full takeover of the product, with impact that can extend to other products.","category":"vendor","who_cares":["oracle-trusted-answer-search","oracle-database"],"confidence":0.8,"needs_auth":"yes","worst_case":"attacker takes over the product and reads, changes or deletes its data","analyst_note":"Find Oracle's July-style Critical Patch Update advisory entry for CVE-2026-101503 to confirm the patch version and any workaround.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-version-26.1"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00049,"input_tokens":3090,"output_tokens":362,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's July-style Critical Patch Update advisory entry for CVE-2026-101503 to confirm the patch version and any workaround.","search":"'-101503':15A,18A '-2026':14A,17A '/av':175C '2026':76B '26.1':41B,110C '3.1':162C,174C '9.9':48B,165C 'access':59B,120C 'account':55B 'addit':143C 'advisori':83B 'affect':108C 'allow':114C 'answer':3A,21A,30B,39B,98C,128C,137C,159C 'attack':117C,139C,148C 'avail':169C 'base':163C 'c/c':180C 'chang':50B,146C 'compon':100C 'compromis':125C 'confidenti':166C 'critic':77B 'cve':13A,16A 'cvss':47B,161C,171C,173C 'databas':26B 'easili':111C 'exploit':89B,112C 'fix':72B,86B 'flaw':6A,46B 'h':183C 'h/a':182C 'h/i':181C 'host':35B 'impact':66B,142C,170C 'integr':167C 'known':93B 'l/pr':177C 'l/ui':178C 'let':7A 'low':9A,53B,115C 'low-privileg':8A,52B 'may':140C 'n/ac':176C 'n/s':179C 'name':84B 'net':58B,123C 'network':119C 'octob':75B 'oracl':1A,23B,25B,28B,37B,57B,80B,96C,122C,126C,135C,157C 'oracle':19A 'oracle-databas':24B 'oracle-trusted-answer-search':27B 'packag':45B,102C 'patch':78B 'pl/sql':44B 'plsql':5A,32B,101C 'poc':92B 'privileg':10A,54B,116C 'product':64B,71B,144C 'public':82B,91B 'reach':69B 'result':153C 'scope':49B,145C 'score':164C 'search':4A,22A,31B,40B,99C,129C,138C,160C 'self':34B 'self-host':33B 'signific':141C 'success':147C 'support':104C 'take':12A,61B 'takeov':155C 'trust':2A,29B,38B,97C,127C,136C,158C 'trusted':20A 'updat':79B 'user':11A 'vector':172C 'vendor':36B 'version':87B,105C 'via':121C 'vulner':94C,113C,132C,151C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101503","severity":null,"published_at":"2026-10-20T22:17:59+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101503:378","url":null,"severity":null,"published_at":"2026-10-23T23:09:12+00:00","modified_at":"2026-10-23T23:09:12+00:00","first_seen_at":"2026-10-23T23:09:12+00:00","fetched_at":"2026-10-23T23:09:12+00:00","note":"Oracle Oct 2026 CPU (cpuoct2026) lists Trusted Answer Search 26.1 as affected; patch is in the Database patch availability doc (MOS, login needed), no fixed version published openly. Severity Daily says only 26.2 is downloadable and nothing clears it. Not exploited, no PoC known. Did not search X."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1810,"url":"https://severitydaily.com/oracle-trusted-answer-search-cve-2026-101501-101503-9-9-scope-change-26-1-affected-26-2-shipping/","title":"Severity Daily: Trusted Answer Search two 9.9s, 26.1 affected, 26.2 shipping","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}