Oracle Trusted Answer Search Flaw Lets Low-Privilege Users Take Over System

Security operations teams are facing a new critical vulnerability in Oracle Trusted Answer Search version 26.1. The flaw resides within the PLSQL package component of the product. According to the National Vulnerability Database, the issue is classified as critical with a CVSS score of 9.9. This rating reflects the severe potential for attackers to compromise the system's confidentiality, integrity, and availability. The vulnerability allows for remote exploitation without requiring user interaction.

In plain English

An attacker does not need high-level credentials to breach this system. The vulnerability allows a user with low privileges to launch an attack. They only require network access through Oracle Net. Once the attack succeeds, the intruder can take complete control of Oracle Trusted Answer Search. This means they can compromise the confidentiality, integrity, and availability of the component. The breach allows for a full takeover of the affected software.

The background

The affected product is Oracle Trusted Answer Search, specifically version 26.1. The weakness is located in the PLSQL package component. While the primary target is this specific search tool, the National Vulnerability Database notes that attacks may significantly impact additional products. This scope change suggests the vulnerability could have broader consequences beyond the immediate component. The flaw is described as easily exploitable, lowering the barrier for potential attackers.

What changes now

Organizations using Oracle Trusted Answer Search version 26.1 must assess their exposure immediately. The vulnerability allows remote attackers to compromise the system with minimal effort. Because the flaw is easily exploitable, the risk of active abuse is significant. Teams should verify if they are running the affected version. If so, they must prepare for potential containment measures. The source material does not confirm if a fix is available.

What made it possible

This incident highlights the risks of insufficient access controls within database components. Attackers often exploit low-privilege accounts to gain initial footholds in networked systems. The weakness allows lateral movement or privilege escalation without strong authentication barriers. Security teams usually monitor for unusual activity from low-privileged users accessing sensitive packages. Checking whether network protocols like Oracle Net are exposed to untrusted zones is standard practice. Isolating critical components reduces the blast radius of such flaws.

What to do and how to stay safe: Oracle

• Verify if your environment runs Oracle Trusted Answer Search version 26.1.
• Monitor network logs for unusual Oracle Net traffic from low-privilege accounts.
• Restrict access to the PLSQL package component to trusted internal networks only.
• Prepare to isolate affected systems until the vendor provides an update.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-101503?

The National Vulnerability Database rates the vulnerability as CVSS 9.9, which is classified as critical.

Which version of Oracle Trusted Answer Search is affected?

Version 26.1 is the supported version that is affected by this vulnerability.

Do attackers need high privileges to exploit this flaw?

No, the vulnerability allows a low-privileged attacker with network access via Oracle Net to compromise the system.