Oracle Trusted Answer Search Has Critical Remote Code Execution Flaw
A CVSS 9.9 vulnerability in Oracle Trusted Answer Search 26.1 allows low-privileged attackers to take over the system via Oracle Net.
Key points
- CVE-2026-101503 affects Oracle Trusted Answer Search version 26.1
- The flaw allows remote takeover with low privilege requirements
- National Vulnerability Database rates the severity as critical
Oracle Trusted Answer Search version 26.1 contains a critical security vulnerability that enables remote attackers to fully compromise the system. The National Vulnerability Database assigned the flaw identifier CVE-2026-101503 and rated it with a maximum CVSS score of 9.9. This high-severity issue resides within the PLSQL package component of the software.
An attacker with network access via Oracle Net can exploit this weakness to take over the Oracle Trusted Answer Search instance. The vulnerability is easily exploitable and requires only low-privileged access to succeed. Successful exploitation results in total loss of confidentiality, integrity, and availability for the targeted system.
Scope and Impact Analysis
The National Vulnerability Database notes that while the flaw exists in Oracle Trusted Answer Search, attacks may significantly impact additional products. This scope change indicates that the compromise could extend beyond the initial component. The CVSS vector reflects high impact across all three core security pillars.
The CVSS 3.1 Base Score of 9.9 confirms the severity as critical. The vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H details the attack path. Network access is sufficient, and no user interaction is required for the exploit to succeed.
Affected Systems and Requirements
Only Oracle Trusted Answer Search version 26.1 is listed as affected by this specific vulnerability. Organizations running this version are exposed to remote takeover attempts. The attack requires network access through Oracle Net, which is a common connectivity method for Oracle databases.
Low-privileged attackers can leverage this flaw, meaning they do not need administrative credentials to initiate the compromise. The ease of exploitation combined with the low privilege requirement makes this a significant risk for any exposed instance. No mitigating factors are listed in the advisory.
What should you do?
Security teams should immediately verify if Oracle Trusted Answer Search version 26.1 is deployed in their environments. If the version is present, restrict network access to Oracle Net ports to trusted sources only. Monitor logs for unusual activity from low-privileged accounts accessing the PLSQL package.
What to do and how to stay safe: Oracle
- Inventory systems to identify any instances of Oracle Trusted Answer Search version 26.1
- Restrict network access to Oracle Net services to minimize exposure to untrusted networks
- Monitor authentication logs for low-privileged accounts attempting to access PLSQL packages
- Prepare to apply updates once the vendor provides a confirmed fix for CVE-2026-101503
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-101503?
The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.9, which is rated as critical.
Which version of Oracle Trusted Answer Search is affected?
Only version 26.1 of Oracle Trusted Answer Search is affected by this vulnerability.
Does this vulnerability require user interaction to exploit?
No, the CVSS vector indicates no user interaction (UI:N) is required for successful exploitation.
