---
id: "CVE-2026-91568"
kind: "vulnerability"
aliases: ["CVE-2026-91568"]
title: "Oracle Database: low-privileged session user can read critical RDBMS data"
severity: "high"
cvss: 7.7
epss: 0.00355
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["database-admins", "oracle-database", "self-hosted", "vendor"]
not_affected_if: ["no-create-session-accounts", "no-untrusted-network-access", "version-outside-range"]
published_at: "2026-10-20T22:20:59+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91568", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91568", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Database: low-privileged session user can read critical RDBMS data

An Oracle Database Server RDBMS flaw affecting versions 23.4.0 through 23.26.3 lets an attacker with only the Create Session privilege reach the database over Oracle Net. A successful attack gives unauthorized access to critical data and possibly all data the RDBMS can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle Database version with `SELECT banner FROM v$version;` and compare it to the affected range 23.4.0 to 23.26.3
- List accounts holding Create Session with `SELECT grantee FROM dba_sys_privs WHERE privilege = 'CREATE SESSION';`
- Confirm whether Oracle Net listeners are reachable from untrusted networks

## Fix

- Move Oracle Database to a patched release from Oracle's July 2026 Critical Patch Update or later, as listed in the Oracle advisory (the exact fixed version is unknown from the sources)
- Restrict the Oracle Net listener to trusted networks until patched
- Revoke Create Session from accounts that do not need it

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91568
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91568

## From the sources

Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS.  While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_