---
id: "CVE-2026-91499"
kind: "vulnerability"
aliases: ["CVE-2026-91499"]
title: "Oracle Database: low-privilege DBMS_VECTOR user can take over RDBMS"
severity: "high"
cvss: 8.8
epss: 0.00389
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["dbms-vector", "oracle-database", "runtime", "self-hosted"]
not_affected_if: ["no-dbms-vector-privilege-granted", "version-outside-23.4.0-23.26.3"]
published_at: "2026-10-20T22:20:54+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91499", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91499", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Database: low-privilege DBMS_VECTOR user can take over RDBMS

Oracle Database Server's RDBMS component has a flaw that lets a low-privilege account holding the DBMS_VECTOR privilege, reached over Oracle Net, take control of the database. Per the CVSS vector, an attacker gets high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the Oracle Database version against the affected range 23.4.0-23.26.3 from the sources; confirm which accounts hold the DBMS_VECTOR privilege. unknown for the exact command.

## Fix

Apply the Oracle Critical Patch Update fix for this CVE; the fixed version is not stated in the sources. Revoke DBMS_VECTOR from accounts that do not need it.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91499
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91499

## From the sources

Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS.  Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_