Zero Radar
← feed
CriticalVulnerabilityCVE-2026-101503updated 25 Oct 2026, 15:24 UTC

Oracle Trusted Answer Search flaw lets low-privileged users take over the product

A weakness in Oracle's Trusted Answer Search lets someone with a basic login reach over the network and take control of the system. Because the flaw can also affect other products, the damage could spread beyond this one application.

Official, 2 sources
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Low-privilege attackerNeeds only a basic account
  2. 2Oracle Net connectionReaches the service over the network
  3. 3PL/SQL package flawAbuses weakness in the package
  4. 4Product takeoverGains control of the application
  5. ResultAttacker takes over the product and can affect others

What happened

A vulnerability in the PL/SQL package of Oracle Trusted Answer Search version 26.1 allows an attacker with low privileges and network access via Oracle Net to fully compromise the product; the scope change means impact can extend to other products.

Why it is dangerous: A successful attack can give full control over confidentiality, integrity and availability of the application, and can reach into connected systems. Organizations running Trusted Answer Search with exposed Oracle Net access are at risk.

Are you affected?

You are affected if you run Oracle Trusted Answer Search 26.1 and users or attackers with low-privileged accounts can reach it over Oracle Net.

Oracle Trusted Answer Search 26.1 (PL/SQL package component)

What to do

  1. Check whether you run Oracle Trusted Answer Search 26.1 and restrict network access via Oracle Net to trusted hosts only
  2. Apply the patch or update from Oracle as soon as it is available for your version
  3. Review accounts with low privileges and remove any that are not needed

Timeline

  1. 20 Oct 2026, 22:17 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:24 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-101503 · GHSA-j6pj-f2h9-xqhf
CVSS
9.9 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Trusted Answer Search flaw lets low-privileged users take over the product · Zero Radar