{"id":"CVE-2026-91568","kind":"vulnerability","aliases":["CVE-2026-91568"],"related":[],"title":"Oracle Database: low-privileged session user can read critical RDBMS data","description":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS.  While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","summary":"An Oracle Database Server RDBMS flaw affecting versions 23.4.0 through 23.26.3 lets an attacker with only the Create Session privilege reach the database over Oracle Net. A successful attack gives unauthorized access to critical data and possibly all data the RDBMS can reach.","severity":"high","cvss":7.7,"epss":0.00355,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-admins","oracle-database","self-hosted","vendor"],"not_affected_if":["no-create-session-accounts","no-untrusted-network-access","version-outside-range"],"how_to_check":"- Check the installed Oracle Database version with `SELECT banner FROM v$version;` and compare it to the affected range 23.4.0 to 23.26.3\n- List accounts holding Create Session with `SELECT grantee FROM dba_sys_privs WHERE privilege = 'CREATE SESSION';`\n- Confirm whether Oracle Net listeners are reachable from untrusted networks","fix":"- Move Oracle Database to a patched release from Oracle's July 2026 Critical Patch Update or later, as listed in the Oracle advisory (the exact fixed version is unknown from the sources)\n- Restrict the Oracle Net listener to trusted networks until patched\n- Revoke Create Session from accounts that do not need it","status":"open","published_at":"2026-10-20T22:20:59+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:10:38+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:10:38Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle Database to a patched release from Oracle's July 2026 Critical Patch Update or later, as listed in the Oracle advisory (the exact fixed version is unknown from the sources)\n- Restrict the Oracle Net listener to trusted networks until patched\n- Revoke Create Session from accounts that do not need it","reach":"network","title":"Oracle Database: low-privileged session user can read critical RDBMS data","impact":"high","summary":"An Oracle Database Server RDBMS flaw affecting versions 23.4.0 through 23.26.3 lets an attacker with only the Create Session privilege reach the database over Oracle Net. A successful attack gives unauthorized access to critical data and possibly all data the RDBMS can reach.","category":"vendor","nicknames":[],"who_cares":["oracle-database","self-hosted","database-admins"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads critical and all RDBMS-accessible data","analyst_note":"Find the Oracle Critical Patch Update advisory and fixed version numbers for the 23.x line; the NVD entry gives no patched release.","how_to_check":"- Check the installed Oracle Database version with `SELECT banner FROM v$version;` and compare it to the affected range 23.4.0 to 23.26.3\n- List accounts holding Create Session with `SELECT grantee FROM dba_sys_privs WHERE privilege = 'CREATE SESSION';`\n- Confirm whether Oracle Net listeners are reachable from untrusted networks","needs_analyst":true,"not_affected_if":["version-outside-range","no-untrusted-network-access","no-create-session-accounts"],"who_is_affected":"Teams running Oracle Database Server 23.4.0 through 23.26.3 with an Oracle Net listener reachable by users or networks they do not fully trust. The attacker needs a valid low-privileged database account with Create Session, so exposure depends on who holds those accounts. Teams on versions outside the listed range, or with no reachable listener, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":3460,"output_tokens":751,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91568':15A,18A '/av':155C '23.26.3':39B,88C '23.4.0':37B,87C '3.1':145C,154C '7.7':148C 'access':60B,102C,132C,138C,142C 'addit':119C 'admin':21B 'affect':35B,85C 'allow':92C 'attack':42B,57B,95C,115C,124C 'base':146C 'c/c':160C 'chang':122C 'complet':137C 'compon':76C 'compromis':107C 'confidenti':149C 'creat':46B,97C 'critic':10A,62B,134C 'cve':13A,16A 'cvss':144C,151C,153C 'data':12A,63B,67B,135C,143C 'databas':2A,20B,24B,31B,51B,79C 'database-admin':19B 'easili':89C 'exploit':90C 'flaw':34B 'give':58B 'h/i':161C 'host':27B 'impact':118C,150C 'l/pr':157C 'l/ui':158C 'let':40B 'low':4A,93C 'low-privileg':3A 'may':116C 'n':163C 'n/a':162C 'n/ac':156C 'n/s':159C 'net':54B,105C 'network':101C 'oracl':1A,23B,30B,53B,78C,104C 'oracle-databas':22B 'possibl':65B 'privileg':5A,48B,94C,99C 'product':120C 'rdbms':11A,33B,69B,75C,108C,114C,141C 'reach':49B,71B 'read':9A 'result':129C 'scope':121C 'score':147C 'self':26B 'self-host':25B 'server':32B,80C 'session':6A,47B,98C 'signific':117C 'success':56B,123C 'support':81C 'unauthor':59B,131C 'user':7A 'vector':152C 'vendor':28B 'version':36B,82C 'via':103C 'vulner':72C,91C,111C,127C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Database Server 23.4.0 through 23.26.3 with an Oracle Net listener reachable by users or networks they do not fully trust. The attacker needs a valid low-privileged database account with Create Session, so exposure depends on who holds those accounts. Teams on versions outside the listed range, or with no reachable listener, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91568","severity":null,"published_at":"2026-10-20T22:20:59+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91568","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91568","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}