{"id":"CVE-2026-101506","kind":"vulnerability","aliases":["CVE-2026-101506"],"related":[],"title":"Oracle Trusted Answer Search: flaw exposes data to low-privileged network attackers","description":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle Trusted Answer Search version 26.1 has a flaw in its Application expert UI component that can be reached over HTTP. An attacker with a low-privileged account can read critical data, and the sources say the impact can reach beyond this product.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","oracle-trusted-answer-search","vendor"],"not_affected_if":["not-running-26.1"],"how_to_check":"- Check the installed Oracle Trusted Answer Search version against `26.1`\n- unknown for any other check, the sources do not say","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Trusted Answer Search, the sources do not name the patched version\n- unknown for further steps","status":"open","published_at":"2026-10-20T22:17:59+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:10:47+00:00","updated_at":"2026-10-25T03:10:47+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:10:47Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Trusted Answer Search, the sources do not name the patched version\n- unknown for further steps","reach":"internet","title":"Oracle Trusted Answer Search: flaw exposes data to low-privileged network attackers","impact":"high","summary":"Oracle Trusted Answer Search version 26.1 has a flaw in its Application expert UI component that can be reached over HTTP. An attacker with a low-privileged account can read critical data, and the sources say the impact can reach beyond this product.","category":"vendor","nicknames":[],"who_cares":["oracle","oracle-trusted-answer-search"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical data and all data accessible to the product","analyst_note":"Confirm the patched version and Oracle advisory link; the NVD entry gives no fix or check details.","how_to_check":"- Check the installed Oracle Trusted Answer Search version against `26.1`\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["not-running-26.1"],"who_is_affected":"Organizations running Oracle Trusted Answer Search version 26.1, where the flaw is in the Application expert UI component reachable over HTTP. The sources do not say which configurations or roles are needed beyond a low-privileged account, so teams not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000612,"input_tokens":3478,"output_tokens":529,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101506':16A,19A '-2026':15A,18A '/av':159C '26.1':32B,88C '3.1':149C,158C '7.7':152C 'access':98C,133C,139C,146C 'account':55B 'addit':120C 'affect':86C 'allow':92C 'answer':3A,24B,29B,75C,105C,114C,144C 'applic':38B,78C 'attack':13A,49B,95C,116C,125C 'base':150C 'beyond':68B 'c/c':164C 'chang':123C 'complet':138C 'compon':41B,77C 'compromis':102C 'confidenti':153C 'critic':58B,135C 'cve':14A,17A 'cvss':148C,155C,157C 'data':7A,59B,136C,147C 'easili':89C 'expert':39B,79C 'exploit':90C 'expos':6A 'flaw':5A,35B 'h/i':165C 'http':47B,100C 'impact':65B,119C,154C 'l/pr':161C 'l/ui':162C 'low':10A,53B,93C 'low-privileg':9A,52B 'may':117C 'n':167C 'n/a':166C 'n/ac':160C 'n/s':163C 'network':12A,97C 'oracl':1A,20B,22B,27B,73C,103C,112C,142C 'oracle-trusted-answer-search':21B 'privileg':11A,54B,94C 'product':70B,121C 'reach':45B,67B 'read':57B 'result':130C 'say':63B 'scope':122C 'score':151C 'search':4A,25B,30B,76C,106C,115C,145C 'signific':118C 'sourc':62B 'success':124C 'support':82C 'trust':2A,23B,28B,74C,104C,113C,143C 'ui':40B,80C 'unauthor':132C 'vector':156C 'vendor':26B 'version':31B,83C 'via':99C 'vulner':71C,91C,109C,128C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Trusted Answer Search version 26.1, where the flaw is in the Application expert UI component reachable over HTTP. The sources do not say which configurations or roles are needed beyond a low-privileged account, so teams not running this product can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101506","severity":null,"published_at":"2026-10-20T22:17:59+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}