{"id":"CVE-2026-91503","kind":"vulnerability","aliases":["CVE-2026-91503"],"related":[],"title":"Oracle Database: VPD flaw lets low-privileged users modify protected data","description":"Vulnerability in the VPD component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as  unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","summary":"Oracle Database Server's Virtual Private Database (VPD) component has a flaw that lets an attacker with a low-privileged account and the Create Table privilege read or change data that VPD policies should restrict. Successful exploitation gives unauthorized create, delete or modify access to critical data and full access to all VPD-protected data.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-admins","oracle-database","package","self-hosted"],"not_affected_if":["no-vpd-policies","unaffected-version"],"how_to_check":"- Check the installed Oracle Database version with `SELECT banner FROM v$version;` and compare it to the affected ranges 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3\n- Identify accounts that hold the Create Table privilege with `SELECT grantee FROM dba_sys_privs WHERE privilege = 'CREATE TABLE';`\n- Confirm whether VPD policies are in use with `SELECT object_owner, object_name, policy_name FROM dba_policies;`","fix":"- Apply the Oracle Critical Patch Update that fixes CVE-2026-91503 for your database release (fixed version: unknown)\n- Revoke the Create Table privilege from accounts that do not need it\n- Restrict Oracle Net access to the database listener to trusted networks","status":"open","published_at":"2026-10-20T22:20:54+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:06:05+00:00","updated_at":"2026-10-25T03:06:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:06:05Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that fixes CVE-2026-91503 for your database release (fixed version: unknown)\n- Revoke the Create Table privilege from accounts that do not need it\n- Restrict Oracle Net access to the database listener to trusted networks","reach":"network","title":"Oracle Database: VPD flaw lets low-privileged users modify protected data","impact":"high","summary":"Oracle Database Server's Virtual Private Database (VPD) component has a flaw that lets an attacker with a low-privileged account and the Create Table privilege read or change data that VPD policies should restrict. Successful exploitation gives unauthorized create, delete or modify access to critical data and full access to all VPD-protected data.","category":"package","nicknames":[],"who_cares":["oracle-database","database-admins","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads and modifies all VPD-protected data in the database","analyst_note":"Find the Oracle Critical Patch Update advisory that lists the fixed release for CVE-2026-91503 and confirm whether the flaw needs any non-default setting.","how_to_check":"- Check the installed Oracle Database version with `SELECT banner FROM v$version;` and compare it to the affected ranges 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3\n- Identify accounts that hold the Create Table privilege with `SELECT grantee FROM dba_sys_privs WHERE privilege = 'CREATE TABLE';`\n- Confirm whether VPD policies are in use with `SELECT object_owner, object_name, policy_name FROM dba_policies;`","needs_analyst":true,"not_affected_if":["unaffected-version","no-vpd-policies"],"who_is_affected":"Oracle Database Servers in the affected version ranges that use Virtual Private Database policies to restrict row access. The attacker must hold a low-privileged account with Create Table and reach the listener over the network. Databases on unaffected versions, or without VPD policies, can skip the patch for this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000731,"input_tokens":3475,"output_tokens":767,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-19.32':102C '-2026':14A,17A '-21.23':104C '-91503':15A,18A '/av':179C '19.3':101C '21.3':103C '23.26.3':107C '23.4.0':106C '3.1':167C,178C '8.1':170C 'access':73B,79B,121C,141C,148C,154C,160C,164C 'account':50B 'admin':21B 'affect':99C 'allow':111C 'attack':44B,114C,129C 'base':168C 'chang':58B 'complet':159C 'compon':37B,90C 'compromis':126C 'confidenti':171C 'creat':53B,69B,116C 'creation':137C 'critic':75B,143C,156C 'cve':13A,16A 'cvss':166C,175C,177C 'data':12A,59B,76B,85B,144C,149C,157C,165C 'databas':2A,20B,24B,30B,35B,93C 'database-admin':19B 'delet':70B,138C 'easili':108C 'exploit':66B,109C 'flaw':4A,40B 'full':78B 'give':67B 'h/a':186C 'h/i':185C 'host':28B 'impact':174C 'integr':173C 'l/pr':181C 'l/ui':182C 'let':5A,42B 'low':7A,48B,112C 'low-privileg':6A,47B 'modif':140C 'modifi':10A,72B 'n':187C 'n/ac':180C 'n/s':183C 'net':124C 'network':120C 'oracl':1A,23B,29B,92C,123C 'oracle-databas':22B 'packag':25B 'polici':62B 'privat':34B 'privileg':8A,49B,55B,113C,118C 'protect':11A,84B 'read':56B 'restrict':64B 'result':134C 'score':169C 'self':27B 'self-host':26B 'server':31B,94C 'success':65B,128C 'support':95C 'tabl':54B,117C 'u/c':184C 'unauthor':68B,136C,153C 'user':9A 'vector':176C 'version':96C 'via':122C 'virtual':33B 'vpd':3A,36B,61B,83B,89C,127C,147C,163C 'vpd-protect':82B 'vulner':86C,110C,132C 'well':151C","nicknames":[],"mitigations":[],"who_affected":"Oracle Database Servers in the affected version ranges that use Virtual Private Database policies to restrict row access. The attacker must hold a low-privileged account with Create Table and reach the listener over the network. Databases on unaffected versions, or without VPD policies, can skip the patch for this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91503","severity":null,"published_at":"2026-10-20T22:20:54+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}