Trusted Answer Search CVE-2026-101504

Requires an authenticated low-privileged account on Oracle Trusted Answer Search 26.1 (PR:L) with access to the Application expert UI component to submit attacker-controlled content, AND requires a second, distinct user (UI:R) - typically a more privileged reviewer or administrator - to interact with/view that content for the payload to trigger. Limiting factors: exploitation is not fully attacker-driven because it depends on victim interaction, valid credentials are needed, and only version 26.1 is identified as affected; these constraints meaningfully reduce the likelihood of opportunistic mass exploitation versus the raw HIGH score.

This is a moderate-priority issue (CVSS 3.1 7.6, HIGH) whose real-world risk is tempered by multiple exploitation gates. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) shows network reach and low attack complexity, but requires an authenticated low-privileged account (PR:L) AND human interaction from a second person (UI:R) - meaning exploitation is not fully attacker-controlled. The high score is driven primarily by the scope change (S:C) and high confidentiality impact (C:H), where the vulnerability in Oracle Trusted Answer Search can significantly impact additional products; integrity impact is only partial (I:L) and there is no availability impact (A:N). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable near-term exploitation - this is a high-CVSS issue without current exploitation signals. The combined PR:L + UI:R profile is characteristic of a stored cross-site-scripting / content-injection flaw where a lower-privileged user plants content that executes against a higher-privileged viewer, which is consistent with the S:C scope change and C:H impact. NOTE: the input tag 'Authentication Bypass' conflicts with the CVSS vector, which requires privileges (PR:L) rather than bypassing authentication - treat that tag as unreliable and verify the true vulnerability class with Oracle's advisory.

A low-privileged authenticated user of Oracle Trusted Answer Search submits malicious content through the Application expert UI. When a higher-privileged user (e.g., an administrator or reviewer) later opens that content, the injected payload executes in the victim's authenticated context, granting access to critical data and partial modification capability, and - due to the scope change - potentially affecting additional connected Oracle products. No public exploit code was identified at time of analysis.