---
id: "CVE-2026-101505"
kind: "vulnerability"
aliases: ["CVE-2026-101505"]
title: "Oracle Trusted Answer Search: low-privilege web flaw exposes data and changes"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Trusted Answer Search", "fixed": ["October 2026 CPU"], "affected": "26.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle", "oracle-trusted-answer-search", "self-hosted", "vendor"]
not_affected_if: ["auth-required"]
published_at: "2026-10-20T22:17:59+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:10:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101505", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:10:27+00:00"}]
---

# Oracle Trusted Answer Search: low-privilege web flaw exposes data and changes

Oracle Trusted Answer Search 26.1, Application expert UI: a low-privileged user with HTTP access can, when another user interacts (UI:R, scope change), read all product data and create, modify or delete critical data. CVSS 3.1 8.7. Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Trusted Answer Search affected 26.1 fixed October 2026 CPU

## How to check

Only version 26.1 is listed as affected. Check your installed Trusted Answer Search version; if it is 26.1 and the October 2026 CPU patch is not applied, you are exposed. Check the patch status in My Oracle Support.

## Fix

Apply the Oracle Critical Patch Update of October 2026 for Trusted Answer Search via My Oracle Support. Oracle gives no separate fixed version number. Until then, restrict Application expert UI access to trusted users (mitigation from Armis, not Oracle).

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101505
- 2026-10-24T00:10:27+00:00 analyst — Oracle CPU Oct 2026 (published 2026-10-20) lists it; CVE record gives CVSS 3.1 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). No exploitation or PoC reported (Armis, VulDB, OpenCVE: KEV no). Fixed version number not published; patch is the CPU via My Oracle Support. Did not search social posts; no CVE-specific conversation likely for an obscure Oracle component.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- [describes] CVE Record: CVE-2026-101505 https://www.cve.org/CVERecord?id=CVE-2026-101505

## From the sources

Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_