This vulnerability resides in the PLSQL package of Oracle Trusted Answer Search version 26.1. An attacker who is low‑privileged but can reach the system over Oracle Net can trigger unauthorized creation, deletion, or modification of data, as well as unauthorized reading of a subset of data. The flaw also permits a deliberate hang or repeatable crash that results in a complete denial‑of‑service for the application. The weakness involves improper access control, missing authorization checks, information disclosure, and uncontrolled resource consumption that can lead to data compromise and DoS.

The affected product is Oracle Trusted Answer Search, specifically the 26.1 release. No other versions are listed as affected in the available data. The issue is confined to the Oracle Net interface used by this component.

The CVSS v3.1 base score of 9.9 indicates a critical severity with impacts on confidentiality, integrity, and availability. The vector shows network attack, low authentication, and scope change, meaning the vulnerability can affect resources beyond the local system. The EPSS score is less than 1 %, indicating that exploitation probability is very low. The vulnerability is not currently listed in the CISA KEV catalog. The attack path requires network access to Oracle Net, which an attacker can obtain from any low‑privileged user with network connectivity. Because the vulnerability exploits a low‑privileged user’s ability to manipulate data and cause a DoS, the potential impact is high if the target system is exposed to untrusted networks.