Oracle Trusted Answer Search contains a flaw in its PL/SQL package that can be exploited by an unauthenticated attacker with Oracle Net network access. When successfully leveraged, the attacker can take over the Trusted Answer Search instance, fundamentally compromising confidentiality, integrity, and availability of the component. The vulnerability delivers full control of the application, allowing arbitrary code or data manipulation.

The exposed product is Oracle Trusted Answer Search, version 26.1. No other versions are identified as affected in the current data.

The CVSS 3.1 Base Score of 8.1 indicates high severity. Attackers can reach Oracle Net remotely without authentication; the EPSS score of < 1% indicates a low exploitation probability, but the lack of a KEV classification means no known widespread exploitation yet. Exploitation requires network access to the Oracle Net port and can be performed from any host that can reach the service, making containment difficult once the vulnerability is known.