Trusted Answer Search EUVD-2026-105917

The attacker must hold a valid low-privileged account with local logon to the infrastructure where Oracle Trusted Answer Search executes (AV:L, PR:L) - there is no remote or unauthenticated path. Exploitation additionally requires human interaction from a person other than the attacker (UI:R), meaning a separate legitimate user must perform some triggering action, and the vulnerability is explicitly rated difficult to exploit with high attack complexity (AC:H). These three limiting factors - local authenticated access, mandatory third-party interaction, and high complexity - substantially reduce realistic risk below what the scope-change flag alone might suggest. The specific triggering feature within the PL/SQL package is not detailed in the available data.

This is a moderate-severity, low-priority issue despite the CRITICAL-sounding scope change. The CVSS 3.1 base score of 5.0 (MEDIUM) is well-supported by the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L: exploitation requires LOCAL logon access (AV:L), HIGH attack complexity (AC:H), an existing low-privileged account (PR:L), and human interaction from a separate user (UI:R) - a stacked set of preconditions that sharply constrains real-world exploitability. The scope change (S:C) and Oracle's note that attacks 'may significantly impact additional products' are the only factors elevating concern, but the per-dimension impacts are all Low (C:L/I:L/A:L), meaning partial read, partial write, and partial DoS rather than full compromise. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis. The combination of local-only vector, high complexity, required privileges, and required third-party interaction makes mass or automated exploitation highly unlikely - this reads as a low-urgency patch-in-normal-cycle item, not an emergency. No signals conflict; the description and CVSS vector are consistent with each other.

A low-privileged user already authenticated to the host running Oracle Trusted Answer Search crafts malicious input to the vulnerable PL/SQL package, then induces a legitimate, higher-context user to perform an action that triggers the flaw. Because of the scope change, the successful attack can partially read, modify, and disrupt data beyond the immediate component. No public exploit code is known, and the high attack complexity plus required human interaction make reliable exploitation difficult.