Oracle Database Server EUVD-2026-106746

Requires a valid Oracle Database account holding the Create Table privilege and network reachability to the database via Oracle Net; the target is the Virtual Private Database (VPD) row-level security feature, so VPD policies must be in use for the impact to matter. Limiting factors: exploitation is authenticated (not pre-auth) and depends on low-privilege accounts being granted Create Table - environments that restrict Create Table to trusted administrators sharply reduce exposure. No user interaction is needed and attack complexity is low once those prerequisites are met. Affected versions: 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3.

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) places this in the High band, driven by network reachability, low attack complexity, no user interaction, and high confidentiality and integrity impact. The one meaningful brake is PR:L: the attacker must already hold a valid database account with the Create Table privilege, so this is a privilege-abuse / security-control-bypass issue rather than a pre-auth internet-facing flaw. No EPSS score, SSVC decision data, KEV listing, or public POC were provided in the input, so exploitation-probability and in-the-wild signals cannot be assessed - the risk rating rests solely on the CVSS vector and Oracle's description. Importantly, the CVSS vector (PR:L) directly contradicts the input 'Authentication Bypass' tag: Oracle's own text describes an authenticated low-privileged attacker, so this is a VPD (Virtual Private Database row-level security) policy bypass, not an authentication bypass - treat the tag as suspect. Real-world priority is genuine for organizations that grant Create Table to semi-trusted or multi-tenant database users, because it undermines VPD as a data-segregation control; it is lower priority where only trusted DBAs hold such privileges. Availability is unaffected (A:N).

A low-privileged user (e.g., an application or reporting account) that holds the Create Table privilege connects to the database over Oracle Net and crafts objects/queries that subvert Virtual Private Database row-level security policies. This lets them read, create, delete, or modify data they should be restricted from, exposing or tampering with critical VPD-protected data across the database. No public exploit was identified at the time of analysis.