Live › vulnerability › CVE-2026-91499
Go to dashboardOracle Database Server's RDBMS component has a flaw that lets a low-privilege account holding the DBMS_VECTOR privilege, reached over Oracle Net, take control of the database. Per the CVSS vector, an attacker gets high confidentiality, integrity and availability impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the Oracle Database version against the affected range 23.4.0-23.26.3 from the sources; confirm which accounts hold the DBMS_VECTOR privilege. unknown for the exact command.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91499")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.