Live › vulnerability › CVE-2026-91568
Go to dashboardAn Oracle Database Server RDBMS flaw affecting versions 23.4.0 through 23.26.3 lets an attacker with only the Create Session privilege reach the database over Oracle Net. A successful attack gives unauthorized access to critical data and possibly all data the RDBMS can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle Database Server 23.4.0 through 23.26.3 with an Oracle Net listener reachable by users or networks they do not fully trust. The attacker needs a valid low-privileged database account with Create Session, so exposure depends on who holds those accounts. Teams on versions outside the listed range, or with no reachable listener, can skip it.
No product ranges from the sources yet.
SELECT banner FROM v$version; and compare it to the affected range 23.4.0 to 23.26.3SELECT grantee FROM dba_sys_privs WHERE privilege = 'CREATE SESSION';Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all RDBMS accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-91568")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.