CVE-2026-91499

Awaiting Analysis Awaiting Analysis - Queue

Oracle Database Server RDBMS Component Privilege Escalation

Publication date: 2026-10-20

Last updated on: 2026-10-24

Assigner: Oracle

Description

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-24

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91499

EUVD

EUVD-2026-106743

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Database Server	23.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0 to 23.26.3. It allows a low-privileged attacker with DBMS_VECTOR privilege and network access to compromise the RDBMS, potentially leading to a full takeover of the database system.

Detection Guidance

Detection requires checking Oracle Database Server versions affected (23.4.0-23.26.3). Use SQL queries to verify DBMS_VECTOR privilege assignments and monitor network access via Oracle Net. No specific commands provided in context.

Impact Analysis

An attacker could exploit this to gain control of the Oracle Database Server, leading to unauthorized access, data theft, data manipulation, or disruption of database services. This could result in significant data breaches or system outages.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating compliance requirements such as GDPR or HIPAA. Organizations using affected Oracle Database versions may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Apply Oracle's security patches for affected versions. Restrict DBMS_VECTOR privilege to only necessary users. Limit network access to Oracle Net via firewalls. Monitor for unusual database activity.

Hi! I’m here to help you understand CVE-2026-91499. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...