{"id":"CVE-2026-101505","kind":"vulnerability","aliases":["CVE-2026-101505"],"related":[],"title":"Oracle Trusted Answer Search: low-privilege web flaw exposes data and changes","description":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","summary":"Oracle Trusted Answer Search 26.1, Application expert UI: a low-privileged user with HTTP access can, when another user interacts (UI:R, scope change), read all product data and create, modify or delete critical data. CVSS 3.1 8.7. Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Trusted Answer Search","fixed":["October 2026 CPU"],"affected":"26.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle","oracle-trusted-answer-search","self-hosted","vendor"],"not_affected_if":["auth-required"],"how_to_check":"Only version 26.1 is listed as affected. Check your installed Trusted Answer Search version; if it is 26.1 and the October 2026 CPU patch is not applied, you are exposed. Check the patch status in My Oracle Support.","fix":"Apply the Oracle Critical Patch Update of October 2026 for Trusted Answer Search via My Oracle Support. Oracle gives no separate fixed version number. Until then, restrict Application expert UI access to trusted users (mitigation from Armis, not Oracle).","status":"open","published_at":"2026-10-20T22:17:59+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:37:11+00:00","updated_at":"2026-10-24T00:10:27+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:37:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Trusted Answer Search: low-privilege web flaw exposes data and changes","impact":"high","summary":"Oracle Trusted Answer Search version 26.1 has a flaw in its Application expert UI that lets a low-privileged user reach the product over HTTP. A successful attack, triggered when another person interacts with it, can read or change data the product holds and can affect other products.","category":"vendor","who_cares":["oracle-trusted-answer-search"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker reads and modifies all data in the product","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched release of Trusted Answer Search 26.1 and whether the Application expert UI fix is listed; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-101505.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000504,"input_tokens":3139,"output_tokens":380,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched release of Trusted Answer Search 26.1 and whether the Application expert UI fix is listed; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-101505.","search":"'-101505':16A,19A '-2026':15A,18A '/av':208C '2026':78B '26.1':38B,102C '3.1':71B,196C,207C '8.7':72B,199C 'access':49B,112C,164C,174C,180C,186C,193C 'addit':147C 'affect':100C 'allow':106C 'anoth':52B 'answer':3A,22A,28B,36B,89C,119C,141C,172C,191C 'applic':39B,92C 'attack':109C,122C,132C,143C,152C 'base':197C 'c/c':213C 'chang':13A,58B,150C 'complet':185C 'compon':91C 'compromis':116C 'confidenti':200C 'creat':64B 'creation':160C 'critic':68B,79B,166C,182C 'cve':14A,17A 'cvss':70B,195C,204C,206C 'data':11A,62B,69B,167C,175C,183C,194C 'delet':67B,161C 'easili':103C 'expert':40B,93C 'exploit':84B,104C 'expos':10A 'fix':73B 'flaw':9A 'h/a':215C 'h/i':214C 'host':32B 'http':48B,114C 'human':124C 'impact':146C,203C 'integr':202C 'interact':54B,125C 'known':83B 'l/pr':210C 'l/ui':211C 'low':6A,44B,107C 'low-privileg':5A,43B 'may':144C 'modif':163C 'modifi':65B 'n':216C 'n/ac':209C 'network':111C 'octob':77B 'oracl':1A,24B,26B,34B,75B,87C,117C,139C,170C,189C 'oracle':20A 'oracle-trusted-answer-search':25B 'patch':80B 'person':128C 'privileg':7A,45B,108C 'product':61B,148C 'r':56B 'r/s':212C 'read':59B 'requir':123C 'result':157C 'scope':57B,149C 'score':198C 'search':4A,23A,29B,37B,90C,120C,142C,173C,192C 'self':31B 'self-host':30B 'signific':145C 'success':121C,151C 'support':96C 'trust':2A,27B,35B,88C,118C,140C,171C,190C 'trusted':21A 'ui':41B,55B,94C 'unauthor':159C,179C 'updat':81B 'user':46B,53B 'vector':205C 'vendor':33B 'version':97C 'via':113C 'vulner':85C,105C,136C,155C 'web':8A 'well':177C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101505","severity":null,"published_at":"2026-10-20T22:17:59+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101505:601","url":null,"severity":null,"published_at":"2026-10-24T00:10:27+00:00","modified_at":"2026-10-24T00:10:27+00:00","first_seen_at":"2026-10-24T00:10:27+00:00","fetched_at":"2026-10-24T00:10:27+00:00","note":"Oracle CPU Oct 2026 (published 2026-10-20) lists it; CVE record gives CVSS 3.1 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). No exploitation or PoC reported (Armis, VulDB, OpenCVE: KEV no). Fixed version number not published; patch is the CPU via My Oracle Support. Did not search social posts; no CVE-specific conversation likely for an obscure Oracle component."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2461,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101505","title":"CVE Record: CVE-2026-101505","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}