Live › vulnerability › CVE-2026-91503
Go to dashboardOracle Database Server's Virtual Private Database (VPD) component has a flaw that lets an attacker with a low-privileged account and the Create Table privilege read or change data that VPD policies should restrict. Successful exploitation gives unauthorized create, delete or modify access to critical data and full access to all VPD-protected data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Oracle Database Servers in the affected version ranges that use Virtual Private Database policies to restrict row access. The attacker must hold a low-privileged account with Create Table and reach the listener over the network. Databases on unaffected versions, or without VPD policies, can skip the patch for this flaw.
No product ranges from the sources yet.
SELECT banner FROM v$version; and compare it to the affected ranges 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3SELECT grantee FROM dba_sys_privs WHERE privilege = 'CREATE TABLE';SELECT object_owner, object_name, policy_name FROM dba_policies;Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the VPD component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-91503")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.