Oracle Database Server CVE-2026-91568

Requires a valid Oracle Database account with the Create Session privilege (a near-universal grant) and network reachability to the Oracle Net listener (typically TCP 1521) of a server running RDBMS version 23.4.0 through 23.26.3. No user interaction, no administrative/DBA privileges, and no special non-default feature are indicated by the data. The primary limiting factor is that exploitation is NOT unauthenticated - an attacker must first possess or obtain low-privilege database credentials - which meaningfully constrains purely external, anonymous exploitation while leaving insider and post-compromise scenarios fully viable.

This is a moderate-to-serious priority driven primarily by its scope and confidentiality impact rather than by evidence of exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) indicates a network-reachable, low-complexity attack requiring only a low-privileged authenticated account (Create Session), with a scope change (S:C) meaning the breach can impact products beyond the RDBMS itself and yield complete read access to all RDBMS-accessible data. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation signals are entirely absent - there is no public exploit identified at time of analysis, and nothing suggests active or automatable exploitation. The practical risk hinges on the fact that PR:L is a very low bar in Oracle environments (Create Session is granted to virtually every database user), making the barrier mostly about any foothold rather than privileged access; combined with S:C and C:H this warrants prompt patching for internet- or intranet-exposed databases. One data conflict to flag: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires authentication (PR:L) - this is NOT an authentication bypass, and the mislabel should not drive prioritization.

An attacker who already holds any ordinary Oracle database account (Create Session privilege) connects to the database listener over Oracle Net and sends a crafted request that exploits the RDBMS flaw, obtaining unauthorized read access to critical data across the RDBMS and, due to the scope change, potentially data belonging to additional products. No user interaction or administrative privileges are required, and attack complexity is low (AC:L), though a valid low-privilege login is a prerequisite. No public exploit identified at time of analysis.