{"id":"CVE-2026-101507","kind":"vulnerability","aliases":["CVE-2026-101507"],"related":[],"title":"Oracle Trusted Answer Search: PLSQL flaw exposes data to low-privileged network users","description":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle Trusted Answer Search version 26.1 has a flaw in its PLSQL package that lets an attacker with low privileges and network access over HTTP read data they should not see. Successful exploitation can expose critical data or all data the product can reach.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","plsql","trusted-answer-search","vendor"],"not_affected_if":["not-version-26.1"],"how_to_check":"- Confirm whether Oracle Trusted Answer Search version `26.1` is deployed\n- unknown","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Trusted Answer Search as published by Oracle\n- unknown","status":"open","published_at":"2026-10-20T22:18:00+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:55:22+00:00","updated_at":"2026-10-25T03:55:22+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:55:22Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Trusted Answer Search as published by Oracle\n- unknown","reach":"network","title":"Oracle Trusted Answer Search: PLSQL flaw exposes data to low-privileged network users","impact":"medium","summary":"Oracle Trusted Answer Search version 26.1 has a flaw in its PLSQL package that lets an attacker with low privileges and network access over HTTP read data they should not see. Successful exploitation can expose critical data or all data the product can reach.","category":"vendor","nicknames":[],"who_cares":["oracle","trusted-answer-search","plsql"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical data and all data accessible to the product","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch and any mitigation for Trusted Answer Search 26.1 to fill how_to_check and fix.","how_to_check":"- Confirm whether Oracle Trusted Answer Search version `26.1` is deployed\n- unknown","needs_analyst":true,"not_affected_if":["not-version-26.1"],"who_is_affected":"Organizations running Oracle Trusted Answer Search version 26.1 that expose its HTTP interface to users with low-privilege accounts. The sources do not describe a specific configuration that makes it exposed beyond that. Teams not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000613,"input_tokens":3438,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101507':17A,20A '-2026':16A,19A '/av':142C '26.1':33B,88C '3.1':132C,141C '6.5':135C 'access':50B,98C,116C,122C,129C 'affect':86C 'allow':92C 'answer':3A,25B,30B,76C,105C,127C 'attack':44B,95C,108C 'base':133C 'complet':121C 'compon':78C 'compromis':102C 'confidenti':136C 'critic':63B,118C 'cve':15A,18A 'cvss':131C,138C,140C 'data':8A,54B,64B,67B,119C,130C 'easili':89C 'exploit':60B,90C 'expos':7A,62B 'flaw':6A,36B 'h/i':148C 'http':52B,100C 'impact':137C 'l/pr':144C 'l/ui':145C 'let':42B 'low':11A,46B,93C 'low-privileg':10A 'n':150C 'n/a':149C 'n/ac':143C 'n/s':146C 'network':13A,49B,97C 'oracl':1A,21B,28B,74C,103C,125C 'packag':40B,80C 'plsql':5A,22B,39B,79C 'privileg':12A,47B,94C 'product':69B 'reach':71B 'read':53B 'result':113C 'score':134C 'search':4A,26B,31B,77C,106C,128C 'see':58B 'success':59B,107C 'support':82C 'trust':2A,24B,29B,75C,104C,126C 'trusted-answer-search':23B 'u/c':147C 'unauthor':115C 'user':14A 'vector':139C 'vendor':27B 'version':32B,83C 'via':99C 'vulner':72C,91C,111C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Trusted Answer Search version 26.1 that expose its HTTP interface to users with low-privilege accounts. The sources do not describe a specific configuration that makes it exposed beyond that. Teams not running this product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101507","severity":null,"published_at":"2026-10-20T22:18:00+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}