{"id":"CVE-2026-91499","kind":"vulnerability","aliases":["CVE-2026-91499"],"related":[],"title":"Oracle Database: low-privilege DBMS_VECTOR user can take over RDBMS","description":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS.  Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Database Server's RDBMS component has a flaw that lets a low-privilege account holding the DBMS_VECTOR privilege, reached over Oracle Net, take control of the database. Per the CVSS vector, an attacker gets high confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":0.00389,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dbms-vector","oracle-database","runtime","self-hosted"],"not_affected_if":["no-dbms-vector-privilege-granted","version-outside-23.4.0-23.26.3"],"how_to_check":"Check the Oracle Database version against the affected range 23.4.0-23.26.3 from the sources; confirm which accounts hold the DBMS_VECTOR privilege. unknown for the exact command.","fix":"Apply the Oracle Critical Patch Update fix for this CVE; the fixed version is not stated in the sources. Revoke DBMS_VECTOR from accounts that do not need it.","status":"open","published_at":"2026-10-20T22:20:54+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:59+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:33:59Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for this CVE; the fixed version is not stated in the sources. Revoke DBMS_VECTOR from accounts that do not need it.","reach":"network","title":"Oracle Database: low-privilege DBMS_VECTOR user can take over RDBMS","impact":"high","summary":"Oracle Database Server's RDBMS component has a flaw that lets a low-privilege account holding the DBMS_VECTOR privilege, reached over Oracle Net, take control of the database. Per the CVSS vector, an attacker gets high confidentiality, integrity and availability impact.","category":"runtime","who_cares":["oracle-database","dbms-vector","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over the database server, reading, changing and disrupting all data","analyst_note":"Find the fixed Oracle Database version and patch in the Oracle Critical Patch Update advisory covering this CVE, linked from the NVD entry.","how_to_check":"Check the Oracle Database version against the affected range 23.4.0-23.26.3 from the sources; confirm which accounts hold the DBMS_VECTOR privilege. unknown for the exact command.","needs_analyst":true,"not_affected_if":["version-outside-23.4.0-23.26.3","no-dbms-vector-privilege-granted"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001014,"input_tokens":3040,"output_tokens":1419,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91499':15A,18A '/av':134C '23.26.3':88C '23.4.0':87C '3.1':121C,133C '8.8':124C 'access':102C 'account':44B 'affect':85C 'allow':92C 'attack':64B,95C,110C 'avail':70B,128C 'base':122C 'compon':34B,76C 'compromis':107C 'confidenti':67B,125C 'control':55B 'cve':13A,16A 'cvss':61B,120C,130C,132C 'databas':2A,24B,30B,58B,79C 'dbms':6A,20B,47B,97C 'dbms-vector':19B 'easili':89C 'exploit':90C 'flaw':37B 'get':65B 'h':142C 'h/a':141C 'h/i':140C 'high':66B 'hold':45B 'host':28B 'impact':71B,129C 'integr':68B,126C 'l/pr':136C 'l/ui':137C 'let':39B 'low':4A,42B,93C 'low-privileg':3A,41B 'n/ac':135C 'n/s':138C 'net':53B,105C 'network':101C 'oracl':1A,23B,29B,52B,78C,104C 'oracle-databas':22B 'per':59B 'privileg':5A,43B,49B,94C,99C 'rdbms':12A,33B,75C,108C,119C 'reach':50B 'result':115C 'runtim':25B 'score':123C 'self':27B 'self-host':26B 'server':31B,80C 'success':109C 'support':81C 'take':10A,54B 'takeov':117C 'u/c':139C 'user':8A 'vector':7A,21B,48B,62B,98C,131C 'version':82C 'via':103C 'vulner':72C,91C,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91499","severity":null,"published_at":"2026-10-20T22:20:54+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91499","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91499","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}