Oracle Database CVE-2026-91563

Exploitation requires the attacker to possess a valid Oracle Database account that has been granted the DBMS_AW privilege, and network reachability to the database listener over Oracle Net (default TNS, typically TCP 1521). No user interaction is required and attack complexity is low. The key limiting factor is the DBMS_AW privilege prerequisite (PR:L) - environments that tightly restrict this privilege and limit network exposure of the Oracle Net listener materially reduce exposure; this is not remotely exploitable by fully unauthenticated attackers. Affected versions are 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3.

This is a genuinely high-priority vulnerability but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a low-complexity, network-reachable attack over Oracle Net that requires only low privileges - specifically an account holding the DBMS_AW privilege - and yields full C:H/I:H/A:H impact (complete OLAP component takeover). This combination of easy exploitation plus total impact is why Oracle rates it 8.8. However, the mitigating reality is PR:L: the attacker must already hold a valid database account with the DBMS_AW privilege, so this is a privilege-escalation/post-authentication issue, not a remote-unauthenticated breach. No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public proof-of-concept referenced, so there is no public exploit identified at time of analysis - the only reference is Oracle's October 2026 Critical Patch Update advisory. SSVC framing: exploitation status is 'none' observed, technical impact is 'total', and automatability is low because valid credentials/privileges are a prerequisite. Net: prioritize patching for any database where untrusted or numerous users hold DBMS_AW, but the authentication prerequisite makes mass, widespread exploitation less likely than a PR:N network flaw would be.

An attacker who already holds a low-privileged Oracle Database account carrying the DBMS_AW privilege connects to the database over Oracle Net and sends crafted requests to the OLAP component, leveraging the flaw to fully compromise OLAP (read/modify data and disrupt availability). Because CVSS indicates AC:L, the attack is reliable once the privilege is held; no user interaction is needed. No public proof-of-concept is referenced, so exploitation would require independent development.