The flaw in Oracle Trusted Answer Search’s Application expert UI lets an attacker with low privileges and network access over HTTP compromise the system. Successful exploitation requires a user other than the attacker to interact, usually through a web request or click, enabling the attacker to create, delete, or modify critical data or gain full read access to all data held by the application, thereby undermining confidentiality and integrity.

Oracle Trusted Answer Search version 26.1 is affected. The vulnerability exists solely in this product and version. No other products or versions are listed as impacted, but attacks may propagate to additional Oracle products accessed via the same UI.

The CVSS 3.1 base score of 8.7 highlights a high‑severity flaw with substantial confidentiality and integrity effects. Exploitation requires only a low‑privilege account and network connectivity, but user interaction limits automation opportunities, suggesting that social engineering or phishing tactics could be used. EPSS data is unavailable and the issue is not cataloged in CISA KEV, yet the combination of wide network exposure and low privilege makes it a tangible risk for systems with an exposed Application expert UI.