Trusted Answer Search EUVD-2026-105918

Exploitation requires network access to the database via Oracle Net plus valid low-privilege credentials (CVSS PR:L) on an instance of Oracle Trusted Answer Search version 26.1 exposing the affected PL/SQL package; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factor is authentication - an attacker must already hold a low-privileged database account, so this is not an anonymous/unauthenticated flaw. The scope change (S:C) means successful exploitation can reach additional Oracle products beyond the vulnerable component, raising impact in multi-product deployments.

This is a genuine high-priority vulnerability on paper: the vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change that lets attacks 'significantly impact additional products' and result in full product takeover. The scope change (S:C) combined with full CIA impact is what drives the score to 9.9 rather than 9.8. However, exploitation signals are thin: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - the only source is Oracle's October 2026 Critical Patch Update advisory. Therefore, despite the near-maximal CVSS, there is no evidence of active or imminent widespread exploitation at time of analysis; the urgency rests on severity potential rather than observed attacker behavior. One signal tension to flag: the input Tags label this 'Information Disclosure,' yet the description and CVSS (I:H/A:H, 'takeover') indicate full compromise well beyond disclosure - treat the tag as understating impact. Prioritize patching because it is an Oracle-maintained, low-complexity, authenticated-network flaw with scope change, but note the real-world exploitation footprint is currently unquantified.

A low-privileged user with Oracle Net access to the database reaches the vulnerable PL/SQL package in Oracle Trusted Answer Search and sends crafted input that abuses the package's logic to escalate and take over the component. Because the vulnerability carries a scope change (S:C), the attacker's impact extends beyond the component into additional Oracle products sharing the environment. No public exploit code is identified at time of analysis, and exploitation requires valid low-privilege credentials.