EUVD-2026-106279
GHSA-7355-33p2-f8mf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Query Optimizer privilege
-
ExploitConnect via Oracle Net
-
ExecutionExploit optimizer flaw in RDBMS
-
ImpactRead unauthorized subset of data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to possess the Oracle 'Query Optimizer' privilege on the target RDBMS and network reachability to the database via Oracle Net (default TNS listener). This high-privilege prerequisite is the primary limiting factor: the attacker must already be an authenticated, privileged database principal, which sharply reduces the realistic threat population to insiders or already-compromised privileged accounts. No user interaction is required and attack complexity is low once the privilege is held. Affected deployments are Oracle Database Server 19.3-19.32 and 21.3-21.23; patched or unaffected versions limit exposure. |
| Impact | This is a low-priority vulnerability despite its network attack vector. The CVSS 3.1 base score of 2.7 (vendor-assigned by Oracle) reflects the combination of AV:N and AC:L against a single, highly restrictive gating factor: PR:H. Exploitation requires an attacker to already hold the 'Query Optimizer' privilege within the RDBMS - a privileged database role, not something a typical user or external actor possesses. The sole impact is C:L (unauthorized read of a subset of RDBMS-accessible data), with no integrity or availability consequences. No EPSS score, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis, and no evidence of active exploitation. The signals are internally consistent - Oracle's low score aligns with the limited confidentiality-only impact and the high privilege requirement. The one conflicting signal is the input 'Authentication Bypass' tag, which contradicts the CVSS vector (PR:H requires valid high privileges, the opposite of an authentication bypass); this tag appears mislabeled and should be disregarded. Net: a genuinely low-risk, privilege-dependent information-disclosure issue that should be patched during routine Oracle CPU cycles, not treated as an emergency. |
| Exploit ScenarioDerived | An attacker who has already obtained a database account carrying the Query Optimizer privilege connects to the Oracle Database over Oracle Net and issues crafted queries that leverage the optimizer flaw to read a subset of RDBMS data they are not authorized to see. No public exploit code is available, and the attack is bounded to read access with no write or denial-of-service effect. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Database Server 19.3 through 19.32 and 21.3 through 21.23 allow a high-privileged database principal holding the Query Optimizer privilege to read a limited subset of RDBMS data it should not be able to access over Oracle Net. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base score 2.7) means the attacker must already be an authenticated, privileged account on the target instance, so the realistic threat population is insiders or holders of compromised privileged credentials rather than anonymous remote attackers, and there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; fixes are delivered through Oracle's October 2026 Critical Patch Update.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update to every affected instance: the 19c line should be brought to the CPU level that supersedes 19.32 and the 21c line to the level superseding 21.23, following the advisory at https://www.oracle.com/security-alerts/cpuoct2026.html, since no standalone fix version is published in the available data (Patch available per vendor advisory). Where patching must be staged, compensating controls are: restrict Oracle Net reachability to the TNS listener with a firewall/allowlist limited to known application hosts (trade-off: breaks unlisted clients and complicates failover/DR paths), and audit and revoke the Query Optimizer privilege from all accounts that do not strictly require it, keeping it only for DBA/application-schema owners who need plan control (trade-off: may break application tuning, stored outlines or statistics-gathering jobs that depend on that privilege). Additionally, alert on grant changes to Query Optimizer and on unusual dictionary/optimizer-statistics access by non-DBA accounts, and rotate credentials for any principal holding the privilege where insider risk or prior compromise is suspected. No vendor-released workaround beyond patching is documented, and no public exploit code has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the RDBMS component of Oracle Database Server and is reachable over Oracle Net (the standard TNS listener path, default port 1521), which is why the attack vector is network-based despite the high privilege requirement. Exploitation is gated on the attacker possessing the Query Optimizer privilege, a powerful role associated with the query transformation and plan-generation subsystem (optimizer statistics, hints and access-path selection), meaning the weakness most plausibly lies in how optimizer-driven code paths resolve object access or metadata rather than in authentication itself. No CWE class was assigned by the reporter, so the root cause is best characterised as an access-control/authorization weakness in a privileged code path that yields confidentiality-only exposure (C:L) with no scope change. Note that third-party tagging labels this as 'Authentication Bypass'; the assessed CVSS vector contradicts that framing, since PR:H explicitly requires a valid authenticated privileged principal, so the tag should not be read as permitting unauthenticated access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Reachable over Oracle Net (AV:N, AC:L) but gated by the Query Optimizer privilege (PR:H); confidentiality-only subset read means C:L, I:N, A:N, scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32 and 21.3-21.23. Easily exploitable vulnerability allows high privileged attacker having Query Optimizer privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB