---
id: "CVE-2026-101503"
kind: "vulnerability"
aliases: ["CVE-2026-101503"]
title: "Oracle Trusted Answer Search: PLSQL flaw lets low-privilege users take over"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Trusted Answer Search", "fixed": [], "affected": "26.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle", "oracle-database", "oracle-trusted-answer-search", "plsql", "self-hosted", "vendor"]
not_affected_if: ["not-version-26.1"]
published_at: "2026-10-20T22:17:59+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-23T23:09:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101503", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:09:12+00:00"}]
---

# Oracle Trusted Answer Search: PLSQL flaw lets low-privilege users take over

Oracle Trusted Answer Search 26.1 has a PL/SQL package flaw (CVSS 9.9, scope change). A low-privileged account with Oracle Net access can take over the product, with impact that can reach other products. Fixed in the October 2026 Critical Patch Update. Oracle's public advisory names no fixed version. No exploitation or public PoC known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Trusted Answer Search affected 26.1 fixed ?

## How to check

Find your Trusted Answer Search version (the installer on Oracle's download page is 26.2). 26.1 is listed as affected. Whether 26.2 is affected or fixed is unclear from public pages, so treat it as in scope until the Oracle Database patch availability document says otherwise. Also check which accounts can execute the product's PL/SQL packages and which hosts can reach the Oracle Net listener.

## Fix

Apply the October 2026 Critical Patch Update patch for Oracle Trusted Answer Search from the Database patch availability document on My Oracle Support (support contract needed). The fixed version number is unknown from public pages. Until patched, restrict Oracle Net access to trusted hosts and review execute privileges on the product's PL/SQL packages.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101503
- 2026-10-23T23:09:12+00:00 analyst — Oracle Oct 2026 CPU (cpuoct2026) lists Trusted Answer Search 26.1 as affected; patch is in the Database patch availability doc (MOS, login needed), no fixed version published openly. Severity Daily says only 26.2 is downloadable and nothing clears it. Not exploited, no PoC known. Did not search X.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- [discussion] Severity Daily: Trusted Answer Search two 9.9s, 26.1 affected, 26.2 shipping https://severitydaily.com/oracle-trusted-answer-search-cve-2026-101501-101503-9-9-scope-change-26-1-affected-26-2-shipping/

## From the sources

Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_