Trusted Answer Search CVE-2026-101506

Exploitation requires an attacker to already hold a valid low-privilege account on Oracle Trusted Answer Search 26.1 (CVSS PR:L) and network HTTP access to the Application expert UI component; no user interaction is needed. The attack is network-based and low-complexity, but the authentication prerequisite is the primary limiting factor - it cannot be performed by a fully unauthenticated attacker despite the 'Authentication Bypass' tag. Risk is amplified by the scope change (S:C), meaning successful exploitation can disclose confidential data belonging to additional Oracle products, not just the search component. Only version 26.1 is listed as affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, with a scope change (S:C) that elevates the score because impact extends beyond the vulnerable component to additional Oracle products. Impact is confidentiality-only (C:H, I:N, A:N) - this is a data-exposure issue, not a code-execution or availability one. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or weaponization; the high-ish base score is driven by the scope change and easy exploitability rather than by demonstrated real-world attacks. A notable conflict exists: the input Tag 'Authentication Bypass' contradicts both the CVSS PR:L metric and the description's explicit 'low privileged attacker' wording, which require valid credentials rather than bypassing authentication - treat the 'Authentication Bypass' characterization as unverified. Net: a genuine confidentiality risk for organizations actually running this product, but prioritization should account for the authentication prerequisite and the absence of any exploitation signal, making this a patch-in-normal-cycle item rather than an emergency unless the product is internet-exposed with low-privilege accounts widely issued.

An attacker holding a low-privilege application account sends crafted HTTP requests to the Application expert UI of Oracle Trusted Answer Search 26.1, abusing the flaw to read data they should not be authorized to access. Because of the scope change, the disclosed data may include information from additional connected Oracle products beyond the search component itself. No public exploit code was identified at time of analysis.