Oracle Trusted Answer Search Has Critical Flaw Allowing Data Modification
A CVSS 9.9 vulnerability in Oracle Trusted Answer Search 26.1 allows low-privileged attackers to compromise data and cause denial of service via Oracle Net.
Key points
- The flaw is rated Critical with a CVSS 3.1 Base Score of 9.9.
- Attackers need only low privileges and network access via Oracle Net.
- Exploitation can lead to data modification, deletion, or complete system crashes.
A critical security vulnerability exists in Oracle Trusted Answer Search version 26.1, allowing remote attackers to compromise the system with minimal effort. The flaw resides in the PLSQL package component and is easily exploitable by low-privileged actors who have network access through Oracle Net.
The National Vulnerability Database lists the issue as CVE-2026-101501 with a CVSS 3.1 Base Score of 9.9. This rating reflects high impacts on confidentiality, integrity, and availability. The vector string indicates that no user interaction is required for exploitation, making the risk particularly severe for exposed systems.
Technical Scope and Impact
Successful exploitation of this vulnerability grants attackers unauthorized access to create, delete, or modify critical data within Oracle Trusted Answer Search. Attackers can also read a subset of accessible data or trigger a hang or frequently repeatable crash, resulting in a complete denial of service.
Although the vulnerability is located specifically within Oracle Trusted Answer Search, the National Vulnerability Database notes that attacks may significantly impact additional products due to a scope change. This suggests that the breach of trust extends beyond the immediate application to other connected Oracle components.
Affected Systems and Access Requirements
The only supported version confirmed to be affected is Oracle Trusted Answer Search 26.1. The attack vector is network-based, meaning the attacker does not need local physical access to the target machine. The complexity of the attack is low, and the required privileges are also low.
Attackers with network access via Oracle Net can leverage this flaw without needing to interact with a user. This combination of low complexity and low privilege requirements makes the vulnerability highly attractive to malicious actors seeking to disrupt services or steal data from Oracle environments.
What should you do?
Organizations using Oracle Trusted Answer Search 26.1 should immediately assess their exposure to this vulnerability. Since the flaw allows remote exploitation via Oracle Net, restricting network access to the service is a priority. Administrators should review firewall rules and ensure that only trusted sources can communicate with the affected component.
What to do and how to stay safe: Oracle
- Restrict network access to Oracle Trusted Answer Search 26.1 to trusted IP addresses only, limiting exposure via Oracle Net.
- Monitor logs for unusual activity or unauthorized attempts to access or modify data within the PLSQL package component.
- Verify that all instances of Oracle Trusted Answer Search are running version 26.1 or later, and check for any pending vendor updates.
- Implement strict access controls and least-privilege principles for accounts that interact with Oracle Net services to reduce the impact of low-privilege attacks.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-101501?
The CVSS 3.1 Base Score is 9.9, which is rated as Critical.
Which version of Oracle Trusted Answer Search is affected?
The supported version that is affected is 26.1.
Can this vulnerability be exploited remotely?
Yes, it is a network-based vulnerability exploitable via Oracle Net without user interaction.
