CVE-2026-83272

Received Received - Intake

Oracle Text Remote Code Execution in Oracle Database Server

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having Create Index privilege with network access via Oracle Net to compromise Oracle Text. While the vulnerability is in Oracle Text, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Text. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83272

EUVD

EUVD-2026-79624

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	database_server	19.3
oracle	database_server	19.32
oracle	database_server	21.3
oracle	database_server	21.23
oracle	database_server	23.4.0
oracle	database_server	23.26.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Oracle Text component of Oracle Database Server. It affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. The issue allows a low-privileged attacker with Create Index privilege to compromise Oracle Text via network access. Successful exploitation could lead to a full takeover of Oracle Text.

Detection Guidance

Detection requires checking Oracle Database Server versions 19.3-19.32, 21.3-21.23, or 23.4.0-23.26.3 for Oracle Text component exposure. Verify if the 'Create Index' privilege is granted to low-privileged users. Use Oracle SQL queries to inspect user privileges and database components.

Impact Analysis

An attacker could gain control over Oracle Text, potentially leading to unauthorized access, data manipulation, or service disruption. This could affect database operations, compromise sensitive data, and impact system availability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to its high confidentiality, integrity, and availability impacts. A successful exploit could lead to unauthorized access or takeover of Oracle Text, compromising sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. The vulnerability's severity (CVSS 8.5) suggests significant risk to data security and regulatory compliance.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) to update the Oracle Text component. Restrict network access to Oracle Net ports and limit Create Index privileges to trusted users only.

Hi! I’m here to help you understand CVE-2026-83272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70