CVE-2026-101502
MediumCVSS 5.0Summary
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package) affects version 26.1. A difficult to exploit flaw requiring human interaction allows a low-privileged attacker with logon to the infrastructure to perform unauthorized update, insert or delete access, unauthorized read access to a subset of data and cause a partial DOS, with potential impact on additional products.
Risk Assessment
An attacker could modify data, read sensitive information and cause partial service unavailability, potentially compromising confidentiality, integrity and availability. The risk affects organizations using Oracle Trusted Answer Search version 26.1.
Recommendation
Apply the security updates provided by Oracle for Oracle Trusted Answer Search. Train users to recognize social engineering attempts.
Other vulnerabilities in Oracle Trusted Answer Search
See all- CVE-2026-101507Medium
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package) affects version 26.1. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all product data.
- CVE-2026-101506High
Vulnerability in Oracle Trusted Answer Search (component Application expert UI) affecting version 26.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data; attacks may significantly impact additional products (scope change).
- CVE-2026-101505High
Vulnerability in Oracle Trusted Answer Search (component Application expert UI) affecting version 26.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data and unauthorized access to critical data; attacks require human interaction and may significantly impact additional products (scope change).
- CVE-2026-101504High
Vulnerability in Oracle Trusted Answer Search (component Application expert UI) affecting version 26.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data and unauthorized update, insert, or delete access to some data; attacks require human interaction and may significantly impact additional products (scope change).
- CVE-2026-101498High
Vulnerability in Oracle Trusted Answer Search (PLSQL package) version 26.1. A difficult-to-exploit network attack via Oracle Net by an unauthenticated attacker can lead to takeover of the component.
- CVE-2026-101503Critical
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package) affecting version 26.1. A low-privileged attacker with network access via Oracle Net can easily exploit it to take over the product, with potential impact on additional products (scope change). CVSS 3.1 Base Score is 9.9.
- CVE-2026-101501Critical
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package) affecting version 26.1. A low-privileged attacker with network access via Oracle Net can easily exploit it to cause unauthorized creation, deletion or modification of critical data, unauthorized read access to a subset of data, and hang or repeatable crash (complete DoS). CVSS 3.1 Base Score is 9.9.
Original NVD description (English source)
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Trusted Answer Search executes to compromise Oracle Trusted Answer Search. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Trusted Answer Search accessible data as well as unauthorized read access to a subset of Oracle Trusted Answer Search accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Trusted Answer Search. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS