Trusted Answer Search CVE-2026-101501

Exploitation requires the attacker to hold a low-privileged account able to communicate with Oracle Trusted Answer Search 26.1 over Oracle Net (the Oracle database network protocol), and to target the vulnerable PLSQL package component. The limiting factors are: (1) valid low-privilege authentication is mandatory (PR:L) - it is not exploitable by a fully anonymous/unauthenticated attacker; (2) network reachability of the Oracle Net listener is required, so systems that restrict Oracle Net exposure to trusted hosts reduce attack surface; (3) only version 26.1 is listed as affected. No special non-default configuration is called out in the description, and no user interaction is needed, which raises realistic risk for any environment where low-privilege accounts and Oracle Net access are broadly granted.

The signals here are only partially complete, and they must be weighed carefully. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change that lets the attacker impact products beyond Oracle Trusted Answer Search itself - this is what drives the near-maximum score. However, several real-world-risk signals are entirely ABSENT from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no indication of public POC code. Per the input, this means 'no public exploit identified at time of analysis' and no confirmed active exploitation. So while the CVSS numerically screams critical, the exploitation-likelihood signals are unknown/empty rather than elevated. One internal tension worth flagging: CVSS marks this AV:N and AC:L ('easily exploitable' per the description), yet it still requires PR:L (a valid low-privileged account on the system via Oracle Net) - so it is NOT unauthenticated internet-wide spray; an attacker must already hold database/application credentials. The C:L (only a subset of data readable) alongside I:H/A:H (full write/modify and complete DOS) indicates the primary danger is integrity and availability, not mass data exfiltration. Net assessment: patch on the normal Oracle CPU cadence with elevated priority because of the scope change and I/A impact, but the absence of KEV/EPSS/POC suggests this is not (yet) evidence of widespread opportunistic exploitation - the authentication requirement meaningfully constrains the attacker population to those with existing low-privilege access.

An attacker who already holds a low-privileged account reachable over Oracle Net sends crafted input to the vulnerable PLSQL package in Oracle Trusted Answer Search 26.1, exploiting it with low attack complexity and no user interaction. Because the scope changes, the attacker leverages the compromised component to modify or destroy critical data and crash the service (complete DOS), potentially affecting additional connected Oracle products. No public exploit code has been identified at time of analysis, so this would require the attacker to develop their own exploit.