Trusted Answer Search CVE-2026-101505

Exploitation requires (1) an existing low-privileged authenticated account on Oracle Trusted Answer Search (PR:L), reachable over the network via HTTP (AV:N), and (2) human interaction from a different, typically higher-privileged user who must view or act on the attacker-supplied content (UI:R) through the Application expert UI component. These two factors - mandatory authentication and a required second human victim - are the primary limiters on real-world exploitation; the flaw cannot be triggered purely by an unauthenticated remote attacker or without a victim interacting. The scope change (S:C) means successful attacks may reach additional products beyond Trusted Answer Search itself. Affected version is confined to 26.1.

This is a genuine high-priority issue (CVSS 3.1 8.7, HIGH) but short of critical, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) describes a network-reachable, low-complexity flaw requiring an authenticated low-privileged attacker (PR:L) plus interaction from a different victim user (UI:R), with a scope change (S:C) and high confidentiality and integrity impact but no availability impact. That profile - authenticated low-priv actor, victim interaction, scope change, C/I impact without A - is the classic fingerprint of a stored cross-site scripting / injection-style flaw in a web UI, not a true pre-auth RCE. No EPSS score, KEV listing, or public POC was provided, so exploitation probability cannot be quantified from the data; per the precision rules this is 'no public exploit identified at time of analysis.' The 'Authentication Bypass' input tag conflicts with the CVSS vector, which requires privileges (PR:L) and therefore pre-existing authentication - treat that tag as suspect rather than as confirmed behavior. Net: prioritize patching in the next Oracle CPU cycle, but the mandatory authentication plus required victim interaction materially lowers real-world mass-exploitation likelihood relative to the raw score.

A low-privileged authenticated user of Oracle Trusted Answer Search submits crafted input through the Application expert UI that is stored and later rendered to a higher-privileged user. When that victim views the content, attacker-controlled actions execute in their session, enabling unauthorized read and modification of critical data and, due to the scope change, impact on additional connected products. No public exploit code was identified at time of analysis.