Trusted Answer Search EUVD-2026-105922

Exploitation requires a valid low-privileged authenticated account on Oracle Trusted Answer Search 26.1 (CVSS PR:L) with network HTTP access to the affected PL/SQL package component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The authentication requirement is the primary limiting factor - this is not exploitable by a fully unauthenticated remote attacker. Impact is confined to confidentiality (reading critical or all accessible data); there is no integrity or availability impact, so the flaw cannot be used directly to modify data or disrupt service. Only version 26.1 is listed as affected.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 6.5, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) in the PL/SQL package component of Oracle Trusted Answer Search 26.1. The signals paint a consistent picture of limited-but-real risk: the attack vector is network-based over HTTP with low complexity, but exploitation requires an already-authenticated low-privileged account (PR:L), which meaningfully constrains the attacker population to users who already have some access. Impact is confidentiality-only (C:H, I:N, A:N) - no integrity or availability loss - so this is a data-exposure issue, not a system-takeover issue. No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the absence of these signals is not itself evidence of safety but does argue against treating this as an emergency. Net assessment: a legitimate patch-cycle priority (especially where the product holds sensitive data and untrusted low-privileged users exist) rather than a drop-everything critical. Conflicting signal to verify: the input Tags include 'Authentication Bypass,' which contradicts the CVSS PR:L requirement and the description's 'low privileged attacker' language - this flaw requires authentication and is not an auth bypass, so the tag appears mislabeled.

A low-privileged authenticated user sends crafted HTTP requests to the Oracle Trusted Answer Search PL/SQL package endpoint and abuses it to read data they are not authorized to see, resulting in disclosure of critical or all application-accessible data. Because attack complexity is low and no user interaction is needed, a valid low-privilege account is the main barrier. No public exploit code was identified in the provided data.