{"id":"CVE-2026-73964","kind":"vulnerability","aliases":["CVE-2026-73964"],"related":[],"title":"Oracle Database Server: high-privilege Query Optimizer flaw leaks some stored data","description":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  21.3-21.23. Easily exploitable vulnerability allows high privileged attacker having Query Optimizer privilege with network access via Oracle Net to compromise RDBMS.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).","summary":"A flaw in the RDBMS component of Oracle Database Server lets a high-privileged user with Query Optimizer rights read a subset of data they should not reach. The attacker must already hold a privileged account and reach the database over Oracle Net.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","oracle-database","package","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Run `SELECT banner FROM v$version;` and compare against the affected releases 19.3 through 19.32 and 21.3 through 21.23\n- Confirm whether the Oracle Net listener is reachable from untrusted networks\n- Review which accounts hold the Query Optimizer privilege","fix":"- Apply the Oracle Critical Patch Update that covers this CVE for your release (exact patch number unknown from sources)\n- Restrict Oracle Net listener access to trusted hosts","status":"open","published_at":"2026-10-20T22:19:49+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:48:03+00:00","updated_at":"2026-10-25T04:48:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:48:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that covers this CVE for your release (exact patch number unknown from sources)\n- Restrict Oracle Net listener access to trusted hosts","reach":"network","title":"Oracle Database Server: high-privilege Query Optimizer flaw leaks some stored data","impact":"low","summary":"A flaw in the RDBMS component of Oracle Database Server lets a high-privileged user with Query Optimizer rights read a subset of data they should not reach. The attacker must already hold a privileged account and reach the database over Oracle Net.","category":"package","nicknames":[],"who_cares":["oracle-database","self-hosted","database"],"confidence":0.6,"needs_auth":"yes","worst_case":"Privileged attacker reads a subset of accessible database data","analyst_note":"","how_to_check":"- Run `SELECT banner FROM v$version;` and compare against the affected releases 19.3 through 19.32 and 21.3 through 21.23\n- Confirm whether the Oracle Net listener is reachable from untrusted networks\n- Review which accounts hold the Query Optimizer privilege","needs_analyst":false,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Only Oracle Database Server releases 19.3 through 19.32 and 21.3 through 21.23 are named as affected. Exposure requires a high-privileged account with the Query Optimizer privilege and network access over Oracle Net, so teams with locked-down listeners and tightly held privileged accounts face little risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00063,"input_tokens":3432,"output_tokens":573,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-19.32':88C '-2026':15A,18A '-21.23':91C '-73964':16A,19A '/av':141C '19.3':87C '2.7':134C '21.3':90C '3.1':131C,140C 'access':105C,122C,128C 'account':64B 'affect':85C 'allow':95C 'alreadi':60B 'attack':58B,98C,113C 'base':132C 'compon':33B,76C 'compromis':110C 'confidenti':135C 'cve':14A,17A 'cvss':130C,137C,139C 'data':13A,52B,129C 'databas':2A,20B,23B,36B,68B,79C 'easili':92C 'exploit':93C 'flaw':9A,29B 'h/ui':144C 'high':5A,41B,96C 'high-privileg':4A,40B 'hold':61B 'host':27B 'impact':136C 'l/i':147C 'l/pr':143C 'leak':10A 'let':38B 'must':59B 'n':149C 'n/a':148C 'n/ac':142C 'n/s':145C 'net':71B,108C 'network':104C 'optim':8A,46B,101C 'oracl':1A,22B,35B,70B,78C,107C 'oracle-databas':21B 'packag':24B 'privileg':6A,42B,63B,97C,102C 'queri':7A,45B,100C 'rdbms':32B,75C,111C,127C 'reach':56B,66B 'read':48B,121C 'result':118C 'right':47B 'score':133C 'self':26B 'self-host':25B 'server':3A,37B,80C 'store':12A 'subset':50B,125C 'success':112C 'support':81C 'u/c':146C 'unauthor':120C 'user':43B 'vector':138C 'version':82C 'via':106C 'vulner':72C,94C,116C","nicknames":[],"mitigations":[],"who_affected":"Only Oracle Database Server releases 19.3 through 19.32 and 21.3 through 21.23 are named as affected. Exposure requires a high-privileged account with the Query Optimizer privilege and network access over Oracle Net, so teams with locked-down listeners and tightly held privileged accounts face little risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73964","severity":null,"published_at":"2026-10-20T22:19:49+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}